# A Two-Stage Anomaly Detection Method Based on User Preference Features and the Deep Fusion Model
## 4 Results
### Time Efficiency Analysis  
In order to verify the improvement of the Spark distributed computing platform on time efficiency, the experiment is set up as follows: under the condition that the total number of processing units of the processor is the same, the driver program based on the MLP neural network is released on a single host and the Spark cluster, respectively, and the cluster number is selected as 2-3, and the number of computing cores in the cluster is 2-8. The training and testing times of clustered operations and stand-alone operations are compared in the experiment. The driver program uses the MLP-Spark, which achieves the best detection performance, as the model to evaluate the time and cost of the training and testing process. The training data is 80% of the CIC DDoS2017 dataset, and the remaining 20% of the data is used as the testing set. The number of training iterations is 100. The MLP neural network has a four-layer structure. The input layer contains 79 neurons, which is equivalent to the feature dimension of the data set. The two hidden layers contain sixteen and eight neurons, respectively, and the output layer contains two neurons. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Methods** & **Accuracy (\%)** & **Recall (\%)** & **Precision (\%)** & **F1-Score** \\ \hline Adaboost [18] & 77 & 84 & - & 0.77 \\ Improved & 81.47 & 85.15 & 94.92 & 0.8977 \\ Adaboost [19] & 96.10 & 96.10 & 96.15 & 0.9595 \\
**Proposed** & & & & \\
**method** & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Detection performance of the proposed methods, Adaboost [18] and Improved Adaboost [19]. Figure 6: Illustration of the detection performance of the models using various types of classifiers. Figure 7: Illustration of the detection performance of the proposed methods, Adaboost [18] and Improved Adaboost [19]. The training process performs iterative operations through the stochastic gradient descent method and derives the neuron weight and bias parameters to obtain the lowest loss function to achieve the training effect. The testing process is to input the test data set into the trained model for prediction and calculate the four evaluation indicators, namely accuracy rate, recall rate, precision rate, and F1-score, with the obtained predicted labels and real labels. Finally, the time spent on the training and testing of the statistical model is used to judge the improvement effect of the Spark cluster on time efficiency. Each group of experiments is repeated three times with the same parameters to reduce the error and improve the accuracy of the experimental results. The experimental results are shown in Figure 8.  
As shown in Figure 5, in the Spark cluster mode, namely when the number of workers is 2-3, as the number of computing cores increases, the time efficiency of model training and model evaluation is significantly improved. When the number of workers is two and the number of cores is four, the optimal time efficiency of model training and model evaluation is obtained. The average time required is 50.05 s and 14.68 s, respectively, compared with the stand-alone running time efficiency of 31.61% and 46.87%. In the case where the number of workers is three, optimal training and testing time efficiency are obtained when the number of cores is five and six, respectively. The corresponding average times are 54.27 s and 14.19 s, which are respectively improved compared with the stand-alone running time by 25.84% and 48.64%. Therefore, it can be shown that the Spark distributed computing platform can effectively improve the efficiency of DDoS attack detection. In the case of stand-alone operations, namely Worker = 1, either in training or model evaluation, under the same computing resources, the time efficiency is far lower than that of Spark cluster mode operations. Furthermore, with the increase in the number of computing cores, the time efficiency of stand-alone operations decreased instead.