# Resampling Imbalanced Network Intrusion Datasets to Identify Rare Attacks
## 8 Results and Discussion
### Resampling before and after Splitting
#### 8.2.1 Random Undersampling before Stratified Splitting
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Oversampling \%** & & **Accuracy** & **Precision** & **Recall** & **F-Score** & **Macro Precision** \\ \hline
0.1 & Avg & 0.9999 & 0.769 & 0.794 & 0.778 & 0.884 \\  & SD & & 0.056 & 0.063 & 0.034 & 0.028 \\  & Avg & 0.9991 & 0.806 & 0.779 & 0.789 & 0.902 \\
0.2 & SD & & 0.065 & 0.09 & 0.058 & 0.032 \\  & Avg & 0.9999 & 0.799 & 0.717 & 0.752 & 0.899 \\
0.3 & SD & & 0.059 & 0.075 & 0.047 & 0.029 \\  & Avg & 0.99991 & 0.802 & 0.783 & 0.787 & 0.901 \\
0.4 & SD & & 0.068 & 0.076 & 0.043 & 0.034 \\  & Avg & 0.999 & 0.836 & 0.871 & 0.852 & 0.918 \\
0.5 & SD & & 0.051 & 0.037 & 0.033 & 0.026 \\  & Avg & 0.999 & 0.828 & 0.851 & 0.838 & 0.914 \\
0.6 & SD & & 0.057 & 0.057 & 0.042 & 0.029 \\  & Avg & 0.999 & 0.849 & 0.88 & 0.862 & 0.924 \\
0.7 & SD & & 0.053 & 0.051 & 0.026 & 0.027 \\  & Avg & 0.999 & 0.847 & 0.851 & 0.847 & 0.924 \\
0.8 & SD & & 0.056 & 0.051 & 0.039 & 0.028 \\  & Avg & 0.999 & 0.807 & 0.892 & 0.845 & 0.903 \\
0.9 & SD & & 0.056 & 0.043 & 0.034 & 0.028 \\  & Avg & 0.999 & 0.818 & 0.75 & 0.782 & 0.909 \\
1.0 & SD & & 0.069 & 0.051 & 0.055 & 0.034 \\  & Averages & & 0.8161 & 0.8168 & 0.8132 & 0.9078 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: UNSW-NB15: Worms—classification results for random undersampling before splitting. Results of [PERSON]'s \(t\)-tests for UNSW-NB15 Shellcode Random Undersampling before Splitting (Table 7) are presented in Table 8. Based on the analysis in Table 8, the best results were obtained at 0.4 oversampling for Shellcode (highlighted in green in Table 7). Table 9 presents the classification results for Random Undersampling Before Splitting for Backdoors (UNSW-NB15) for the various oversampling percentages (0.1 to 1.0, at intervals of 0.1). The best results are highlighted in green. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Oversampling \%** & \multicolumn{2}{c}{**Accuracy**} & **Precision** & **Recall** & **F-Score** & **Macro Precision** \\ \hline
0.1 & Avg & 0.9996 & 0.849 & 0.941 & 0.892 & 0.924 \\  & SD & 0.013 & 0.014 & 0.012 & 0.006 \\
0.2 & Avg & 0.9997 & 0.889 & 0.969 & 0.927 & 0.944 \\  & SD & 0.015 & 0.01 & 0.007 & 0.007 \\
0.3 & Avg & 0.9997 & 0.896 & 0.962 & 0.927 & 0.948 \\  & SD & 0.013 & 0.012 & 0.007 & 0.006 \\
0.4 & Avg & 0.9997 & 0.898 & 0.958 & 0.927 & 0.949 \\  & SD & 0.008 & 0.008 & 0.007 & 0.004 \\  & Avg & 0.9996 & 0.887 & 0.964 & 0.924 & 0.944 \\
0.5 & SD & 0.014 & 0.007 & 0.007 & 0.007 \\  & Avg & 0.9996 & 0.876 & 0.964 & 0.918 & 0.938 \\
0.6 & SD & 0.012 & 0.014 & 0.008 & 0.006 \\  & Avg & 0.9995 & 0.844 & 0.925 & 0.883 & 0.922 \\
0.7 & SD & 0.012 & 0.013 & 0.009 & 0.006 \\  & Avg & 0.9995 & 0.846 & 0.932 & 0.887 & 0.923 \\
0.8 & SD & 0.012 & 0.013 & 0.005 & 0.006 \\  & Avg & 0.9995 & 0.849 & 0.929 & 0.887 & 0.924 \\
0.9 & SD & 0.013 & 0.01 & 0.007 & 0.006 \\  & Avg & 0.9996 & 0.855 & 0.939 & 0.895 & 0.928 \\
1 & SD & 0.014 & 0.014 & 0.008 & 0.007 \\  & Averages & 0.9996 & 0.8689 & 0.9483 & 0.9067 & 0.9344 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: UNSW-NB15: Shellcode—classification results for random undersampling before splitting.