# Resampling Imbalanced Network Intrusion Datasets to Identify Rare Attacks
## 8 Results and Discussion
### Resampling before and after Splitting
#### 8.2.1 Random Undersampling before Stratified Splitting
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Oversampling \%** & \multicolumn{2}{c}{**Accuracy**} & **Precision** & **Recall** & **F-Score** & **Macro Precision** \\ \hline
0.4 & Avg SD & 0.9998 & 0.97 & 0.956 & 0.963 & 0.985 \\  & Avg SD & & 0.007 & 0.009 & 0.005 & 0.003 \\
0.5 & Avg SD & 0.9998 & 0.97 & 0.951 & 0.961 & 0.985 \\  & SD & & 0.007 & 0.008 & 0.005 & 0.003 \\
0.6 & Avg SD & 0.9998 & 0.965 & 0.954 & 0.96 & 0.982 \\
0.7 & SD & & 0.007 & 0.009 & 0.005 & 0.003 \\  & Avg 0.9997 & 0.968 & 0.946 & 0.957 & 0.984 \\  & SD & & 0.006 & 0.011 & 0.006 & 0.003 \\
0.8 & Avg SD & 0.9998 & 0.966 & 0.95 & 0.958 & 0.983 \\  & SD & & 0.005 & 0.01 & 0.006 & 0.002 \\
0.9 & Avg SD & 0.9998 & 0.967 & 0.957 & 0.962 & 0.983 \\
1 & Avg SD & & 0.008 & 0.006 & 0.004 & 0.004 \\  & Averages & 0.9998 & 0.968 & 0.952 & 0.96 & 0.984 \\  & SD & & 0.009 & 0.01 & 0.008 & 0.004 \\  & Averages & 0.99978 & 0.9667 & 0.954 & 0.9604 & 0.9832 \\ \hline \end{tabular}
\end{table} 
Table 9: _Cont._Results of [PERSON]'s \(t\)-tests for UWF-ZeekData22 Credential Access Random Undersampling before Splitting (Table 11) are presented in Table 12. Based on the analysis in Table 12, the best results were obtained at 0.5 oversampling for credential access (highlighted in green in Table 11). \begin{table}
\begin{tabular}{c c c c c c c} \hline
**Oversampling \%** & \multicolumn{2}{c}{**Accuracy**} & **Precision** & **Recall** & **F-Score** & **Macro Precision** \\ \hline \multirow{3}{*}{0.1} & Avg & 0.999 & 0.742 & 0.889 & 0.801 & 0.871 \\  & SD & & 0.134 & 0.165 & 0.126 & 0.067 \\  & Avg & 0.999 & 0.885 & 0.911 & 0.891 & 0.942 \\  & SD & & 0.05 & 0.139 & 0.075 & 0.024 \\  & Avg & 0.999 & 0.847 & 0.867 & 0.849 & 0.923 \\  & SD & & 0.101 & 0.147 & 0.107 & 0.05 \\  & Avg & 0.999 & 0.836 & 0.856 & 0.83 & 0.918 \\  & SD & & 0.106 & 0.165 & 0.107 & 0.053 \\  & Avg & 0.999 & 0.936 & 0.911 & 0.919 & 0.968 \\  & SD & & 0.069 & 0.109 & 0.072 & 0.034 \\  & Avg & 0.999 & 0.906 & 0.867 & 0.87 & 0.953 \\  & SD & & 0.103 & 0.163 & 0.094 & 0.052 \\  & Avg & 0.999 & 0.882 & 0.922 & 0.894 & 0.941 \\  & SD & & 0.067 & 0.122 & 0.06 & 0.033 \\  & Avg & 0.999 & 0.826 & 0.911 & 0.853 & 0.913 \\  & SD & & 0.143 & 0.097 & 0.084 & 0.071 \\  & Avg & 0.999 & 0.829 & 0.967 & 0.889 & 0.915 \\  & SD & & 0.079 & 0.071 & 0.054 & 0.04 \\  & Avg & 0.99998 & 0.832 & 0.911 & 0.864 & 0.916 \\  & SD & & 0.109 & 0.097 & 0.076 & 0.054 \\  & Averages & 0.9991 & 0.8521 & 0.9012 & 0.866 & 0.926 \\ \hline \end{tabular}
\end{table} 
Table 11: UWF-ZeekData22: credential access—classification results for random undersampling before splitting. \begin{table}
\begin{tabular}{c c c c c c c} \hline
**Welch’s \(t\)-Test** & **Precision \(t\)-Value** & **Recall \(t\)-Value** & **F-Score \(t\)-Value** & **Macro Precision** & **Analysis** \\ \hline \multirow{3}{*}{0.1 vs. 0.2} & \multirow{3}{*}{\(-3.162\)} & \multirow{3}{*}{\(-0.322\)} & \multirow{3}{*}{\(-1.941\)} & \multirow{3}{*}{\(-3.155\)} & 0.2 is better than 0.1 \\  & & & & & & 0.2 and 0.3 are \\  & & & & & & 0.2 is better than 0.4 \\  & & & & & & 0.2 is better than 0.4 \\  & & & & & & in F-score \\  & & & & & & 0.5 is better than  
Table 13 presents the classification results for Random Undersampling Before Splitting for Privilege Escalation (UWF-ZeekData22) for the various oversampling percentages (0.1 to 1.0, at intervals of 0.1). The best results are highlighted in green. Results of [PERSON]'s \(t\)-tests for UWF-ZeekData22 Privilege Escalation Random Undersampling before Splitting (Table 13) are presented in Table 14. Based on the analysis in Table 14, the best results were obtained at 0.1 oversampling for privilege escalation (highlighted in green in Table 13). Though there are sampling ratios that are statistically equivalent to 0.1 (as shown in Table 14), 0.1 was chosen as the best since 0.1 has the smallest amount of oversampled data, thus taking the least computational time.