# Unsupervised Feature Selection for Outlier Detection on Streaming Data to Enhance Network Security
## 7 Conclusions and Future Work
Instead of using existing datasets, we will apply UFSSOD in a real world computer network (no labeled data available) in parallel to classifiers without feature selection to examine the differences in classification results. A recently proposed method [69] might be applied to exploit and evaluate the outcome of outlier detection for novel attack pattern recognition on streaming data with and without the application of UFSSOD's feature selection. Since in the current configuration, measurements only relied on the \(\gamma_{min}\) functionality with respect to Algorithm 3, a part of our future work will be comparing it with the _distance_ functionality, which tends to result in more features, leading to higher computational costs, but might improve the classification task even further. Additionally, a more thorough testing of the outlier scaling and its combination across multiple online detection approaches will be performed. In terms of UFSSOD's operation modes, the discussion of results revealed inferior performance of xStream applied in the true online setting compared to \(\text{Lodar}_{\text{Two Hist. }}\)'s windowed setting. Within the scope of our future work is also to apply xStream in the windowed setting and check which mode--sequential or parallel--is in general more effective and why. Since UFSSOD's main purpose is the streaming feature selection for outlier detection, further evaluation should also include the latest online outlier detection methods, e.g., PCB-iForest [70]. Inspired by approaches used in CINFO or ODEFS and the nature of UFSSOD to provide outlier candidates, in future work we will examine the possibility of applying supervised FS, similarly to sparse Lasso regression in CINFO, based on pseudo-labels obtained from UFSSOD's outlier candidates. Thus, not only the pure nature of Loda's functioning will form the basis for FS but it may also be improved by shrinking the solution, resulting in a number of features that are not correlated to the outlier score. To even further alleviate the circumstance that FS is performed independently of the subsequent online OD method, possibly yielding a suboptimal and biased solution for OD, we might include outlier candidates from the Unsupervised Online OD module as well. Instead of performing iterative validations to reduce the loss in an offline setting having all data objects available, we will research possibilities to do so in a slimmed-down online fashion by exploiting the strength of theoretically infinite running time of SD. Conceptualization, M.H. ; methodology, M.H. and E.W. ; software, M.H. and E.W. ; validation, M.H. and D.F. ; writing--original draft, M.H. ; visualization, M.H. and E.W. ; writing--review and editing, M.H., E.W., D.F. and M.S. ; supervision, D.F. and M.S. ; funding acquisition, D.F. and M.S. ; project administration, M.S. All authors have read and agreed to the published version of the manuscript. This research work is partially supported by the research project 13 FH645 IB6 of the German Federal Ministry of Education and Research as well as by the Ministry of Education, Youth, and Sports of the Czech Republic under grant No. LO1506. Not applicable. The 'ODDS' datasets utilized for the evaluation in this article are available from the site [[http://odds.cs.stonybrook.edu/about-odds/](http://odds.cs.stonybrook.edu/about-odds/)]([http://odds.cs.stonybrook.edu/about-odds/](http://odds.cs.stonybrook.edu/about-odds/)) (accessed on 5 March 2021). The authors declare no conflict of interest.