# Intrusion Detection Method Based on Preprocessing of Highly Correlated and Imbalanced Data
## 3 Results
### Model Selection, Training, and Evaluation
#### 3.4.2 Evaluation the Effectiveness of Using the Feature Space SP_PCA Reduction Procedure  
For the comparison of the effectiveness of the SP_PCA reduction procedure, the feature space was also reduced using VarianceThreshold and Random Forest methods. VarianceThreshold removes features with low variance by specifying a deviation threshold, excluding columns in which a certain percentage of labels match. For example, if we want to remove features where more than 80% of the labels are similar, we can set the VarianceThreshold to 0.16 (calculated as 0.8 \(\times\) (1 \(-\) 0.8)). This threshold ensures that features with low discriminatory power will be rejected. Random Forest considers the average contribution of each feature to all decision trees in the ensemble. The higher the importance is, the greater the feature affects predictions. Thus, Random Forests provide a simple way to select features based on importance scores. After fitting the model to the training data, we can access the feature importance parameter and use it in the further construction of classification models. As shown in Figure 3, using SP_PCA to reduce correlation resulted in a 26% reduction in the number of features, VarianceThreshold reduced them by 14%, and Random Forest reduced them by 19%, compared to the original (raw) data. Further studies are related to the assessment of the quality of the model after the feature space reduction stage. To compare the effectiveness of SP_PCA, VarianceThreshold, and Random Forest, classification models based on decision tree, KNN, Logistic Regression, SVM, Gradient Boosting, and Random Forest were created. We evaluate the following key performance metrics: Average F1 score, Training Time, and Recognition Time. The results of the method assessment are shown in Table 3.  
Figure 3: Results of reducing dataset. As can be seen from Table 3, the reduction in the feature space allowed for a reduction in the inference time of almost all models or an improvement their prediction time. The F1 score metrics of all the models have increased as well. The best result was obtained by using the ensemble classifier based on the Random Forest model. As a result, the integrated use of the SMOTEENN data balancing method and the SP_PCA procedure improved the F1 score of the Random Forest-based model from 95% to 97% (an additional 2% after the data-balancing step). The training time decreased from 16.51 s to 15.58 s. Testing time was reduced by 29%. Since the SP_PCA and VarianceThreshold algorithms are more effective for this dataset, we combined these two algorithms in further research to reduce the feature space. 4.3 Evaluation of the Effectiveness of the Integrated Use of the SP_PCA and VarianceThreshold Reduction Procedure  
To reduce the feature space, two algorithms, SP_PCA and VarianceThreshold, were combined sequentially. The result, shown in Figure 4, demonstrates that the combination of SP_PCA and VarianceThreshold algorithms led to a reduction in the feature space from 42 (for raw data) to 28. To evaluate the combined use of the SP_PCA and VarianceThreshold methods, Decision Tree, KNN, Logistic Regression, SVM, Gradient Boosting, and Random Forest were used as base classifiers. The proposed procedure reduced the model's training time and improved recognition time. As shown in Figure 5, the training time for the Random Forest model was reduced by 16%, and the recognition time was improved by 32% (Figure 6). At the same time, the F1 score of the models hardly changed (Figure 7) compared to the results obtained by applying