## 3 Material and Methods
### Evaluation Metrics  
Model performance is evaluated using accuracy, detection rate (DR), false positive rate (FPR), f1-score, and area under the curve (AUC) metrics. Elements of these metrics can be retrieved from the confusion matrix where the confusion matrix is {TP, TN, FP, FN}. True positive (TP) means correctly classified attack packets. True negative (TN) means correctly classified normal packets. False positive (FP) means incorrectly classified attack packets, and false negative (FN) means incorrectly classified normal packets. Accuracy represents the ratio of correctly identified packets versus total number of packets. \[\mathrm{Accuracy}=\frac{\mathrm{TP+TN}}{\mathrm{TP+TN+FP+FN}} \tag{8}\]  
The detection rate represents the ratio of correctly identified attacks versus predicted attacks. \[\mathrm{Detection\,Rate}=\frac{\mathrm{TP}}{\mathrm{TP+FN}} \tag{9}\]  
The false positive rate is the ratio of incorrectly identified attacks versus predicted normal. \[\mathrm{FPR}=\frac{\mathrm{FP}}{\mathrm{FP+TN}} \tag{10}\]  
The F1-score is the harmonic mean of precision and recall (detection rate), where precision is defined as the accuracy of predicting normal packets as normal. \[\mathrm{F1-score}=\frac{2(\mathrm{TP})}{2(\mathrm{TP})+\mathrm{FP+FN}} \tag{11}\]  
The area under the curve measures the overall performance of a binary classifier. It is expressed in terms of false positive rate and true positive rate, where the true positive rate (TPR) represents the proportion of normal packets that are correctly identified. \[\mathrm{AUC}=\sum_{i=1}^{n-1}\frac{1}{2}\left(\mathrm{FPR}_{i+1}-\mathrm{FPR }_{i}\right)\,\left(\mathrm{TPR}_{i}-\mathrm{TPR}_{i+1}\right) \tag{12}\]  
Comparing the performance of 10, 12, and 15 components (see Table 5), DNN remains the best classifier. The top metrics of the voting ensemble were received when 15 components were used. In this case, it gave 94.34% accuracy, a 5.23% false positive rate, a 94.32% f1-score, and 94.34% AUC. The only exception is the detection rate; the top metric of detection rate, 94.40%, is received when 10 components were used. The higher the number of components, the more data variance is captured and the better the representation is, which gave us better performance metrics. Table 2 shows 20 top-ranked features, which are determined using the RFE technique at the feature selection stage. The cumulative sum of PCA is explained and the variance ratio is shown in Table 4. This table shows the outcome of the feature extraction process. Using 10, 12, and 15 components, we captured the following ratios of the cumulative sum of data variance: 0.9193, 0.9538, and 0.9896. The highest variance is captured when 15 components are used. When we increase the number of components, the cumulative sum of the data variance also increases. We captured 98.96% variance using only 15 components, far less than the input features space of size 42 we had. We compared our work with contemporary research in the field of network anomaly detection (see Table 6). We achieved higher accuracy by utilizing a smaller number of \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Research**} & \multicolumn{2}{c}{**Dimensionality**} & \multirow{2}{*}{**Features**} & \multirow{2}{*}{**Classifier**} & \multirow{2}{*}{**Accuracy**} \\  & \multicolumn{1}{c}{**Reduction Technique**} & & & \\ \hline
[25] & XGBoost & 19 & DT & 90.85\% \\ \hline
[38] &
\begin{tabular}{c} Rao Optimization \\ Algorithm \\ \end{tabular} & 19 & SVM & 92.5\% \\ \hline
[22] & Genetic Algorithm & 16 & RF & 87.61\% \\ \hline
[21] & PCA & 2 & SVM-rbf & 93.94\% \\ \hline
[20] & IG, RF and RFE & 23 & MLP & 84.24\% \\ \hline Proposed & \multirow{2}{*}{RFE and PCA} & \multirow{2}{*}{15} & \multirow{2}{*}{Voting Ensemble} & \multirow{2}{*}{94.3\%} \\ Approach & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Performance comparison (UNSW-NB15).