# Multi-Resolution Analysis with Visualization to Determine Network Attack Patterns
## 6 Results and Discussion
Since the PCA projections were performed to the statistically validated DWT features (\(\alpha=150\) and \(\beta=10\)), we found good clustering results. For the NSLKDD dataset, we could not find significant differences among different distance metrics. However, for the Kyoto2016 and CICIDS2017 datasets, different results were found. These might have happened because there was no clear visual separation between normal and attack events in the visualizations. Overall, the clustering accuracy with the Pearson correlation coefficient was slightly higher than other distance metrics. Figure 6: Average F1 scores \(\pm\) SEM for all classification algorithms with different window and step sizes. (**A**) DWT features with \(\alpha\) variation; (**B**) DWT features with \(\beta\) variation; (**C**) PCA features with \(\alpha\) variation; (**D**) PCA features with \(\beta\) variation. When applying the clustering technique, a significantly longer computational time was required to analyze the datasets (especially for the Kyoto2016 and CICIDS2017). This is because a large number of attributes are often generated depending on the sizes of wavelet window and step. As mentioned before, PCA is applied to generate visual representations by reducing the overall number of input attributes (i.e., dimensions). However, when applying PCA to determine appropriate principal components, evaluating confidence interval (\(\theta\)) is needed because it determines the error rate between the input and PCA projected data. For example, when mapping high-dimensional data into a low-dimensional projection space (often 2D or 3D spaces are utilized), an optimal projection space (\(n\)-D space) can be found by evaluating the measured eigenvectors of the covariance matrix from the input data. Of course, it is not easy to determine the optimal projection space when the number of attributes and instances is huge. In analyzing network traffic data,  
Figure 7: Visualizations of the analyzed \(k=2\) clusters with different distance metrics (Euclidean distance (L\({}^{2}\)), Chebyshev distance (L\({}^{\infty}\)), City-block distance (L\({}^{1}\)), and Pearson correlation coefficient (R\({}^{2}\))) on the PCA features within visualizations using an Agglomeration hierarchical clustering technique. The determined clusters are represented as solid connected lines. (**A**) Clustering result for the NSLKDD dataset with L\({}^{2}\); (**B**) Clustering result for the NSLKDD dataset with L\({}^{\infty}\); (**C**) Clustering result for the NSLKDD dataset with L\({}^{1}\); (**D**) Clustering result for the NSLKDD dataset with R\({}^{2}\); (**E**) Clustering result for the Kyoto2006 dataset with L\({}^{2}\); (**F**) Clustering result for the Kyoto2006 dataset with L\({}^{\infty}\); (**G**) Clustering result for the Kyoto2006 dataset with L\({}^{1}\); (**H**) Clustering result for the Kyoto2006 dataset with R\({}^{2}\); (**I**) Clustering result for the CICIDS2017 dataset with L\({}^{2}\); (**J**) Clustering result for the CICIDS2017 dataset with L\({}^{\infty}\); (**K**) Clustering result for the CICIDS2017 dataset with L\({}^{1}\); (**L**) Clustering result for the CICIDS2017 dataset with R\({}^{2}\). minor PCA components (having smaller eigenvalues) cannot be ignored because they may include essential attributes that can be used to discover anomalies [68]. Therefore, in our visualization, the user is allowed to change the default principal components (i.e., the first two principal components) to others. This would benefit intrusion detection analysis because it helps the user analyze the data thoroughly with different PCA components. In data classification analysis, Random Forest (RF) is often utilized. Since it builds many individual trees with bootstrapping, it has been known as a good technique for analyzing data that comes with categorical or numerical outcomes.