# Unsupervised Feature Selection for Outlier Detection on Streaming Data to Enhance Network Security
## 6 Discussion of Results
### Comparison of FSDS, IBFS and UFSSOD with the Best 25% Features  
First, we compare the results for \(\gamma\) set to the 25% of the top-ranked features for FSDS, IBFS, and UFSSOD. The reason behind only considering the top 25% is that if the FS algorithm is able to rank the features according to their contribution of anomalousness properly, the results should, even with this limited amount of features, be noticeable for the task of OD. If one of the FS algorithms yielded poor results even for the top features, we could show its non-applicability to the task of OD. The results of the \(F1/avg\_t\) metric are shown in Table 4. We have chosen the \(F1/avg\_t\) metric in this setup since, independently of IBFS being an offline FS algorithm, we wanted to include the information of the tradeoff between classification and computational performance, especially to compare FSDS with UFSSOD, being of online nature. Since we have also compared feature subsets of the same cardinality, this approach is legitimate. Nevertheless, the results for \(F1\) show a similar behavior. It is noted that FSDS is able to process more than only one sample at each time \(t\). The implementation used, required 10 samples at each time to function properly. Thus, the results, with regard to \(avg\_t\), would be even worse for FSDS if it only processed 1 instead of 10 samples due to a longer runtime. Surprisingly, for some datasets, FSDS performs comparably or even better than IBFS or UFSSOD. However, for those datasets even randomly choosing 25% of \(d\) features perform mostly comparable as well and the better \(F1/avg\_t\) is mostly explained by the better average runtime of FSDS compared to IBFS and UFSSOD, especially for datasets with a high dimension. For instance, with _musk_ (\(d=100\)), IBFS and UFSSOD have an approximately 29% higher runtime compared to all FSDS subset results. For better comprehensibility, two exemplary plots of the \(F1\) for _letter_ and _musk_ are shown in Figure 6 where IBFS and UFSSOD performed poorly and FSDS achieves better results. For _letter_ in Figure 6, the overall \(F1\) is quite poor, also showing that randomly choosing 25% of features achieves results comparable to the other subsets. It is due to the nature of both IBFS and UFSSOD, being based on an OD algorithm, that if the overall \(F1\) is poor, to not reliably score the feature contributions with regard to their anomalousness. With an overall decent \(F1\) achieved by the subsets in _musk_ (Figure 6), one can clearly see that IBFS and UFSSOD perform significantly better than the random subset and for most of the FSDS subsets with different \(k\). \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline
Figure 7 shows the \(F1\) results of datasets where IBFS and UFSSOD performed well and an overall decent \(F1\) could be achieved. In all subfigures it can be seen that both IBFS and UFSSOD achieved better results than randomly selecting 25% of features, proving that even for this fixed small amount of features, IBFS and UFSSOD are able to score features reliably according to their contribution of anomalousness. Two key outcomes can be noted. First, in most of the cases FSDS could not achieve better results than randomly selecting features while IBFS and UFSSOD are able to produce better ones. Second, independent of the used parameter \(k\), the results significantly vary for each \(k\) per dataset without any pattern apparent, e.g., the smaller the dimension the smaller the \(k\). Even if promising results can occasionally be obtained for some \(k\), without any pattern behind, one is not able to properly set the parameter. Those individual cases, e.g., in Figure 7d with FSDS and \(k=1\), might be explained by FSDS' ability to find redundancy among features in a higher dimension, which scored worse and coincidentally might not contain any outliers. Thus, their removal will positively affect the \(F1\). However, this way of sorting out irrelevant features is not the actual intention of FS for the task of OD.