# Unsupervised Feature Selection for Outlier Detection on Streaming Data to Enhance Network Security
## 6 Discussion of Results
### Comparison of IBFS and UFSSOD with Different Feature Sets  
Since FSDS did not prove to be a promising candidate for OD, we have proceeded our result discussion by comparing IBFS and UFSSOD. Because of applying different feature set lengths and an offline with an online algorithm, we now focus on the results of the \(F1\) metric for different subsets, as shown in Table 5, since we do not want to blur results with shorter average runtimes. For only two datasets, _optdigits_ and _satellite_, using all features is more promising whereas, for _optdigits_, the feature subsets perform much worse. For _satellite_ the \(F1\) scores across all columns are comparable. A better picture of the bad performance for _optdigits_ can be made by examining the feature scores \(\hat{s}_{f(t)}\), as shown in Figure 9. The red crosses mark those features that are returned by \(\text{ufssod\_clustering}\) applied on the scores of IBFS and UFSSOD. From a number of 64 features for full dimension, \(\text{ufssod\_clustering}\) applied on IBFS and UFSSOD only marks 9 features to be the most important. Since for _optdigits_ it generally applies that the higher the number of features in the subset the better the score, even the measurements with 75% of features seems not sufficient enough. Again, this is supporting the assumption that for _optdigits_ outliers tend to occur in any feature. An overall \(F1\) of only 0.158 by using all features shows that the online OD algorithms also performed quite poorly on this dataset. Even if IBFS and UFSSOD with the \(\text{ufssod\_clustering}\) subset performed approximately 7% faster with regard to \(\text{\emph{avg\_t}}\), considering the \(F1/\text{\emph{avg\_t}}\) metric for all subsets depicted in Figure 10, it did not significantly influence the results at all. Figure 8: Exemplary plots for feature scores \(\hat{s}_{f(t)}\) of IBFS (**a**,**c**) and UFSSOD (**b**,**d**) applied on _musk_ (**a**,**b**) and _satellite_ (**c**,**d**) (the more intense the color, the higher the score, and the more important the feature). \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline \multirow{2}{*}{ID} & \multirow{2}{*}{ID} & \multirow{2}{*}{ID} & \multirow{2}{*}{ID} & \multirow{2}{*}{ID} & \multirow{2}{*}{ID} & \multirow{2}{*}{ID} & \multirow{2}{*}{ID} & \multirow{2}{*}{ID} & \multirow{2}{*}{ID} & \multirow{2}{*}{ID} & \multirow{2}{*}{ID} \\  & & &  
Independently of whether using IBFS or UFSSOD, in the majority of cases using a subset of features performs better than using the full set. For better comprehensibility, two exemplary plots for datasets that have achieved decent \(F1\) scores are shown in Figure 11. In Figure 11, it can be seen that using all 100 features of the _mnist_ dataset degrades the classification performance, whereas \(\text{ufssod\_clustering}\) with 37 (IBFS) and 21 (UFSSOD) features achieved very good results in terms of \(F1/avg\_t\). For UFSSOD, slightly more features as shown with the 25% measurement would have achieved even better results. Figure 11 shows the results for the \(wbc\) dataset and that it is not always better to choose a high percentage of top scoring features. From the 30 features in total, using \(\text{ufssod\_clustering}\) with 10 (IBFS) and 14 (UFSSOD), features achieved much better results than subsets with a higher number. In order to show the influence of applying \(\text{ufssod\_clustering}\) for IBFS or UFSSOD for each classifier, we refer to Table 6. As a representative example with the \(wbc\) dataset, the percentage increase or decrease of the metrics \(avg\_t\) and \(F1\) compared to the measurements using the full feature dimension is shown. For each classifier, applying \(\text{ufssod\_clustering}\), whether on IBFS or UFSSOD, could decrease the runtime by approximately 12% on average considering the significant improvement on Kitsune. The \(F1\) score could be increased by approximately 14% on average.