# Resampling Imbalanced Network Intrusion Datasets to Identify Rare Attacks
## 8 Results and Discussion
### Resampling before and after Splitting
#### 8.2.1 Random Undersampling before Stratified Splitting
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Welch’s \(t\)-Test** & **Precision \(t\)-Value** & **Recall \(t\)-Value** & **F-Score \(t\)-Value** &
\begin{tabular}{c} **Macro Precision** \\ _t-Value_ \\ \end{tabular} & **Analysis** \\ \hline
0.1 vs. 0.2 & \(-6.530\) & \(-5.250\) & \(-8.049\) & \(-6.537\) & 0.2 is better than 0.1 \\
0.2 vs. 0.3 & \(-1.093\) & \(1.438\) & \(-0.107\) & \(-1.092\) & 0.2 better than 0.3 \\
0.2 vs. 0.4 & \(-1.613\) & \(2.616\) & \(-0.005\) & \(-1.609\) & 0.2 has better recall \\
0.4 vs. 0.5 & \(2.015\) & \(-1.784\) & \(0.888\) & \(2.012\) & 0.5 has better recall \\
0.4 vs. 0.6 & \(4.557\) & \(-1.176\) & \(2.507\) & \(4.553\) & 0.4 is better than 0.6 \\
0.4 vs. 0.7 & \(11.157\) & \(6.763\) & \(11.799\) & \(11.163\) & 0.4 is better than 0.7 \\
0.4 vs. 0.8 & \(11.097\) & \(5.620\) & \(13.965\) & \(11.110\) & 0.4 is better than 0.8 \\
0.4 vs. 0.9 & \(10.104\) & \(7.201\) & \(12.712\) & \(10.113\) & 0.4 is better than 0.9 \\
0.4 vs. 1 & \(8.290\) & \(3.908\) & \(9.362\) & \(8.296\) & 0.4 is better than 1.0 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Welch’s \(t\)-test results: UNSW-NB15: Shellcode—random undersampling before splitting. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Oversampling \%** & \multicolumn{2}{c}{**Accuracy**} & **Precision** & **Recall** & **F-Score** & **Macro Precision** \\ \hline
0.1 & Avg & 0.9998 & 0.962 & 0.96 & 0.961 & 0.981 \\  & SD & & 0.006 & 0.006 & 0.003 & 0.003 \\  & Avg & 0.9998 & 0.969 & 0.964 & 0.966 & 0.984 \\
0.2 & SD & & 0.009 & 0.007 & 0.006 & 0.004 \\  & Avg & 0.9997 & 0.962 & 0.95 & 0.956 & 0.981 \\
0.3 & SD & & 0.005 & 0.01 & 0.005 & 0.003 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: UNSW-NB15: Backdoors—classification results for random undersampling before splitting. Table 11 presents the classification results for Random Undersampling Before Splitting for Credential Access (UWF-ZeekData22) for the various oversampling percentages (0.1 to 1.0, at intervals of 0.1). The best results are highlighted in green. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Welch’s \(t\)-Test Results (\(\boldsymbol{p<0.10}\))** & **Precision \(\boldsymbol{t}\)-Value Recall \(\boldsymbol{t}\)-Value F-Score \(\boldsymbol{t}\)-Value \(t\)-Value** & **Macro Precision \(t\)-Value** & **Analysis** \\ \hline
0.1 vs. 0.2 & \(-1.813\) & \(-1.602\) & \(-2.697\) & \(-1.818\) & 0.2 is better than 0.1 across all metrics \\ \hline
0.2 vs. 0.3 & \(1.955\) & 3.627 & 4.492 & \(1.970\) & 0.2 is better than 0.1 across all metrics \\ \hline
0.2 vs. 0.4 & \(-0.404\) & 2.338 & 1.491 & \(-0.397\) & 0.2 is better than 0.4 in recall and F-score \\ \hline
0.2 vs. 0.5 & \(-0.474\) & 3.866 & 2.359 & \(-0.464\) & 0.2 is better than 0.5 in recall and F-score \\ \hline
0.2 vs. 0.6 & \(1.070\) & 2.621 & 2.861 & \(1.079\) & 0.2 is better than 0.6 in recall and F-score \\ \hline
0.2 vs. 0.7 & 0.189 & 4.415 & 3.563 & 0.206 & 0.2 is better than 0.7 in recall and F-score \\ \hline
0.2 vs. 0.8 & 0.829 & 3.661 & 3.254 & 0.842 & 0.2 is better than 0.8 in recall and F-score \\ \hline
0.2 vs. 0.9 & 0.524 & 2.378 & 2.136 & 0.531 & 0.2 is better than 0.9 in recall and F-score \\ \hline
0.2 vs. 1.0 & 0.180 & 3.043 & 2.149 & 0.189 & 0.2 is better than 1.0 in recall and F-score \\ \hline \hline \end{tabular}
\end{table} 
Table 10: [PERSON]’s \(t\)-test results: UNSW-NB15: Backdoors—random undersampling before splitting.