# Reducing the False Negative Rate in Deep Learning Based Network Intrusion Detection Systems
## 7 Conclusions  
This research focused on building a deep neural network and training it on two modern datasets for binary and multiclass classification. Despite other works in the literature, the primary goals of our research were to lower the False Negative Rate as much as possible while still keeping the False Positive Rate low and increasing the detection rate of minority classes (classes with a low number of records). We proposed a strategy made of three points: correction of the training and testing subset distribution, feature selection, and usage of \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Experiment** & **Class** & **Precision** & **Recall** & **F1 Score** & **No. of Records** \\ \hline \multirow{4}{*}{Full features} & Analysis & 16\% & 2\% & 3\% & 455 \\ \cline{2-7}  & Backdoor & 14\% & 3\% & 5\% & 394 \\ \cline{2-7}  & Shellcode & 60\% & 28\% & 38\% & 304 \\ \cline{2-7}  & Worms & 0\% & 0\% & 0\% & 38 \\ \hline \multirow{4}{*}{Reduced features} & Analysis & 0\% & 0\% & 0\% & 455 \\ \cline{2-7}  & Backdoor & 0\% & 0\% & 0\% & 394 \\ \cline{2-7}  & Shellcode & 49\% & 24\% & 33\% & 304 \\ \cline{2-7}  & Worms & 0\% & 0\% & 0\% & 38 \\ \hline \multirow{4}{*}{Class weights} & Analysis & 23\% & 3\% & 5\% & 455 \\ \cline{2-7}  & Backdoor & 13\% & 82\% & 22\% & 394 \\ \cline{1-1} \cline{2-7}  & Shellcode & 20\% & 45\% & 28\% & 304 \\ \cline{1-1} \cline{2-7}  & Worms & 15\% & 13\% & 14\% & 38 \\ \hline \hline \end{tabular}
\end{table} 
Table 25: Performance metrics for minority classes in UNSW-NB15 multiclass experiments. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Exp. Name** & **Training Accuracy** & **Prediction Accuracy** & **Precision** & **Recall** & **F1 Score** & **ROC AUC** & **FNR** \\ \cline{2-7}  & Full features & 97.91\% & 97.87\% & 97.55\% & 97.87\% & 97.65\% & 99.87\% & 16.48\% \\ \hline Reduced features & 97.91\% & 97.7\% & 97.44\% & 97.7\% & 97.48\% & 99.85\% & 12.69\% \\ \hline Class weights & 97.25\% & 97.25\% & 98.2\% & 97.25\% & 97.55\% & 99.83\% & 0.77\% \\ \hline \hline \end{tabular}
\end{table} 
Table 24: Comparison of the results achieved in the UNSW-NB15 multiclass classification experiments. class weights. We ran an experimental campaign for two well-established datasets to verify the effectiveness of our strategy in lowering the FNR and increasing the performance of minority classes. In almost all of the experiments, a combination of feature selection and the assignment of correct class weights during the training phase of the neural network gave the best results in lowering the FNR. We observed that the assignment of the class weights needs to be used with caution since it can easily lead to over-fitting and an increase in the FPR. Even when used correctly, it will still give a slight increase in the FPR, as seen from the experiments in this research, but the number is still considered low enough. Only in the case of binary classification for the NSL-KDD dataset the usage of class weights was not the best method for achieving the lowest FNR. A more effective correction was modifying the distribution of the train and test subsets. Regarding multiclass classification, feature selection with class weights proved to be the best method to increase the performance of the minority classes. Compared to the work surveyed in Section 3, the neural network models constructed in our research incidentally outperform all of them in terms of accuracy, except [35]. This comparison can be seen in the overview given in Table 3. In terms of accuracy, our model reached accuracy values >99% for the NSL-KDD dataset, which is higher than the accuracy achieved by other models on the same dataset, both for binary and multiclass classification. When it comes to the results achieved for the UNSW-NB15 dataset, our proposed model reached the accuracy of >98% for binary classification, and >97% for multiclass classification.