# Combining Unsupervised Approaches for Near Real-Time Network Traffic Anomaly Detection
## 4 Experiment
### Discussion  
From the results obtained in the experiments carried out in the present work, it is possible to observe that the proposed algorithms have reached performances comparable with the state-of-the-art Anomaly Detection algorithms. Particularly, for the dataset KDDCUP99, the best performances are obtained using the MemAE-EIF algorithm, which reaches an F1-score index equal to 0.9234 and an AUROC index equal to 0.9219. Immediately after the MemAE-EIF algorithm, the EIF and DAGMM-EIF algorithms are ranked with an F1-score value of 0.9177 and 0.9157 and an AUROC value of 0.9177 and 0.9158, respectively.  
For the NSL-KDD dataset, the best performance is obtained using the MemAE-EIF algorithm, which achieves an F1-score index of 0.9172 and an AUROC index of 0.9172. It can be observed how the proposed algorithms achieve performances that improve the Deep Learning algorithm used as a base. In particular, the performance obtained using the DAGMM algorithm is lower than the performance obtained using the DAGMM-EIF algorithm for all the datasets examined. Similarly, the performance obtained using the DA algorithm is lower than the performance obtained using the algorithm in combination with the Extended Isolation Forest in each of the three datasets evaluated.  
For the CIC-IDS2017 dataset, the performance obtained using the DAGMM-EIF and DA-EIF algorithm is higher than the performance obtained using the DAGMM and DA algorithms, respectively. However, the performance obtained using the MemAE-EIF algorithm is superior to that obtained using the MemAE algorithm only in some of the computed metrics. In particular, both algorithms achieve the same F1-score value, but the MemAE-EIF algorithm's accuracy index is higher than the accuracy index calculated for the basic MemAE algorithm.  
Figure 7: Bar graph of SHAP values calculated for the CIC-IDS2017 dataset using the EIF model of the MemAE-EIF algorithm.  
For the CIC-IDS2017 dataset, the best performance is obtained using the MemAE-EIF and MemAE algorithms. In particular, both algorithms achieve the same result for the F-score index, but the MemAE-EIF algorithm allows for a sharp increase in precision at the expense of recall. In particular, for the dataset CIC-IDS2017, the MemAE and MemAE-EIF algorithms reach an F1-score index of 0.7146 and an AUROC index of 0.7146 and 0.6972, respectively. It is interesting to highlight how the precision index calculated for the MemAE-EIF algorithm reaches a score of 0.7431, while the basic MemAE algorithm obtains a precision score of 0.7146. From the obtained results, it is possible to prove that all the proposed algorithms improve the accuracy of the Deep Learning algorithms used as a base. Moreover, the MemAE-EIF algorithm achieves the best precision and F1-score for all the datasets examined. From the analysis carried out in Section 4.4, it is possible to observe that the internal characteristics introduced by the MemAE-EIF algorithm influence the prediction process of the EIF model, which allows a high precision to be reached in reporting anomalous events and therefore reduces the number of false alarms. This result is relevant in a real-world context in which false alarms are handled by experts in the field, taking their time away from analysis and response related to real cyber attacks.