## 5 Results
### Performance
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Mode** & **Thresh.** & **Hours** & **Precis.** & **Recall** & **Accur.** & **F2** \\ \hline Single 5\% & 0.25 & First 3 & **0.185** & **0.740** & **0.413** & **0.463** \\ \cline{2-6}  & & Last 3 & 0.167 & 1.000 & 0.167 & 0.500 \\ \cline{2-6}  & 0.5 & First 3 & **0.178** & **0.360** & **0.617** & **0.299** \\ \cline{2-6}  & & Last 3 & 0.167 & 1.000 & 0.167 & 0.500 \\ \cline{2-6}  & 1 & First 3 & **1.000** & **0.020** & **0.837** & **0.025** \\ \cline{2-6}  & & Last 3 & 0.155 & 0.620 & 0.373 & 0.388 \\ \hline Single 10\% & 0.25 & First 3 & **0.175** & **0.686** & **0.397** & **0.433** \\ \cline{2-6}  & & Last 3 & 0.163 & 1.000 & 0.163 & 0.494 \\ \cline{2-6}  & 0.5 & First 3 & **0.184** & **0.373** & **0.613** & **0.309** \\ \cline{2-6}  & & Last 3 & 0.163 & 1.000 & 0.163 & 0.494 \\ \cline{2-6}  & 1 & First 3 & **1.000** & **0.039** & **0.837** & **0.049** \\ \cline{2-6}  & & Last 3 & 0.155 & 0.633 & 0.377 & 0.391 \\ \hline Single 25\% & 0.25 & First 3 & **0.172** & **0.756** & **0.417** & **0.450** \\ \cline{2-6}  & & Last 3 & 0.183 & 1.000 & 0.183 & 0.529 \\ \cline{2-6}  & 0.5 & First 3 & **0.160** & **0.356** & **0.623** & **0.286** \\ \cline{2-6}  & & Last 3 & 0.183 & 1.000 & 0.183 & 0.529 \\ \cline{2-6}  & 1 & First 3 & **1.000** & **0.089** & **0.863** & **0.109** \\ \cline{2-6}  & & Last 3 & 0.194 & 0.709 & 0.407 & 0.463 \\ \hline Multi 5\% & 0.25 & First 3 & **0.716** & **1.000** & **0.753** & **0.927** \\ \cline{2-6}  & & Last 3 & 0.628 & 0.883 & 0.580 & 0.817 \\ \cline{2-6}  & 0.5 & First 3 & **0.747** & **0.947** & **0.767** & **0.898** \\ \cline{2-6}  & & Last 3 & 0.528 & 0.584 & 0.383 & 0.572 \\ \cline{2-6}  & 1 & First 3 & **1.000** & **0.599** & **0.750** & **0.651** \\ \cline{2-6}  & & Last 3 & 0.516 & 0.406 & 0.360 & 0.424 \\ \hline Multi 10\% & 0.25 & First 3 & **0.615** & **0.665** & **0.537** & **0.654** \\ \cline{2-6}  & & Last 3 & 0.663 & 1.000 & 0.663 & 0.908 \\ \cline{2-6}  & & Last 3 & 0.663 & 1.000 & 0.663 & 0.908 \\ \cline{2-6}  & 1 & First 3 & **1.000** & **0.016** & **0.393** & **0.02** \\ \cline{2-6}  & & Last 3 & 0.555 & 0.558 & 0.410 & 0.557 \\ \hline Multi 25\% & 0.25 & First 3 & **0.692** & **0.608** & **0.510** & **0.623** \\ \cline{2-6}  & & Last 3 & 0.660 & 1.000 & 0.660 & 0.907 \\ \cline{2-6}  & 0.5 & First 3 & **0.530** & **0.239** & **0.280** & **0.268** \\ \cline{2-6}  & & Last 3 & 0.660 & 1.000 & 0.660 & 0.907 \\ \cline{2-6}  & & Last 3 & 0.660 & 1.000 & 0.660 & 0.907 \\ \cline{2-6}  & 1 & First 3 & **1.000** & **0.063** & **0.307** & **0.078** \\ \cline{2-6}  & & Last 3 & 0.577 & 0.586 & 0.443 & 0.584 \\ \hline \end{tabular}
\end{table} 
Table 2: ARMA performance data for the “nodecov” term of ERGM model. Overall, the findings indicate that there is value in labeling devices and incorporating such labels in the analysis of communication between the in graphs. Regardless of the injection mode or threshold, node covariance appeared to surpass the summative metric based on the weight of edges. This makes intuitive sense since an increase in particular traffic link over two devices may appear to be significant; however, knowing what is the role of these devices increases the contextual understanding of an event. For example, a server would rarely communicate as devices with one another, yet a host communicating with a server is a much more likely event. Changes in either of these communication channels can have a different significance.