# Unsupervised Feature Selection for Outlier Detection on Streaming Data to Enhance Network Security
## 6 Discussion of Results
### Application of UFSSOD, xStream, and Loda Two Hist. in a Streaming Setting  
Measurement results for the streaming setting with regard to the sequential and parallel approach (Figures 2 and 3) are shown in Table 7. The \(F1\) score results are averaged by the results of UFSSOD, xStream, LodaTwo Hist. and their logical _or_-combination stated in Section 5.3. For only two datasets, _cardio_ and _optdigits_, using all features achieved better classification performance than using a subset. However, instead of yielding worse results, the subsets performed comparably to the full set. Taking into account the average runtime decrease using a subset, as shown in Figure 12b, for _optdigits_, UFSSOD with ufssod_clustering even achieved a better tradeoff than the other settings. For _cardio_ the \(F1/avg\_t\) could not provide better results. The reason why ufssod_clustering has a higher influence on the result of the \(F1/avg\_t\) metric on _optdigits_ than on _cardio_ is due to the fact that with only 21 (_cardio_) and 64 (_optdigits_) the number of dimensions can be reduced more significantly in the latter case. Therefore, the average runtime can also be reduced more notably. Since the \(avg\_t\) of _cardio_ with its minor number of features can be reduced only marginally with ufssod_clustering, the dominating factor remains the \(F1\) score. In three dataset measurements, _letter_, _mnist_ and _satellite_, ufssod_clustering applied in a streaming setting to xStream and LodaTwo Hist. yielded the best results. We have neglected _letter_ since the overall \(F1\) score is poor across all feature sets and therefore the results are \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**ID** & **full\_dim** & **ufssod\_25** & **ufssod\_50** & **ufssod\_75** & **ufssod\_ckm** \\ \hline
2 & **0.435** & 0.404 & 0.402 & 0.416 & 0.390 \\
5 & 0.083 & 0.083 & 0.088 & 0.076 & **0.093** \\
6 & 0.161 & 0.282 & 0.229 & 0.204 & **0.328** \\
8 & **0.136** & 0.097 & 0.122 & 0.108 & 0.113 \\
9 & 0.154 & 0.169 & **0.186** & 0.159 & 0.170 \\
11 & 0.349 & 0.391 & 0.389 & 0.384 & **0.396** \\
12 & 0.267 & 0.247 & 0.247 & **0.271** & 0.254 \\
13 & 0.425 & 0.350 & 0.455 & **0.456** & 0.394 \\
14 & 0.039 & 0.075 & **0.077** & 0.075 & 0.056 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: \(F1\) results for UFSSOD using different \(\gamma\) (feature subsets) for datasets with ID \(i\) in streaming setting with xStream and LodaTwo Hist. (full_dim refers to using all features \(\gamma=d\), * -25,50,75 refers to setting \(\gamma\) to the top scoring 25, 50, and 75% features and *_ckm refers to the top-\(\gamma\)-features obtained by ufssod_clustering, best performing feature set in bold). Figure 12: \(F1/avg\_t\) results for badly-performing datasets _cardio_ (**a**) and _optdigits_ (**b**) referring to Table 7.  
non-significant. For _mnist_, ufssod_clustering notably achieved the best \(F1\) compared to the other feature sets, where even when using all features, it performed the worst. With _mnist_'s 100 dimensions, the good result is improved, shown in Figure 12(a), considering the significant reduction of features resulting in a runtime decrease of approximately 40% and thus a better \(F1/avg\_t\) metric. Even for _satellite_ having only 36 dimensions, this effect takes place, shown in Figure 12(b), where the _avg_t_ is being decreased by approximately 20%. In order to show the influence of applying UFSSOD to xStream and LodaTwo Hist., we refer to Table 8 showing the percentage increase or decrease of the metrics _avg_t_ and \(F1\) compared to the measurements using the full feature set. For all datasets, xStream achieves better results with UFSSOD in terms of _avg_t_ with an overall improvement of approximately 11% compared to the measurements using all features. However, with an average runtime per dataset (full dimension) of approximately 590 sec yielding 0.27 s/sample across all datasets, xStream's Python implementation of StreamAD does not seem very efficient compared to our LodaTwo Hist.