# A Local Feature Engineering Strategy to Improve Network Anomaly Detection +
## 8 Conclusions and Future Directions  
Today's scenario of modern societies, heavily dependent on the use of an ever-increasing number of network-based services, private and public, generates a huge number of network events related to these activities, which security systems, such as the IDSs, should process as quickly as possible. Unfortunately, the requested short response time in terms of events classification should go hand in hand with its reliability, since a wrong events classification leads toward a series of problems, both case of both false positives and false negatives (i.e., intrusions identified as normal events and vice versa).  
For these reasons, the research activity in this area involves a large number of people and capital, with the aim to develop effective techniques and strategies able to face the problem. The challenges are mainly related to some open problems that affect this field, such as a data domain characterized by a high degree of data imbalance and the heterogeneity/dynamism of the involved network events.  
The idea behind the LFE strategy proposed in this work revolves around the observation that an improvement in terms of event characterization given by the introduction of several new features, locally calculated for each network event on the basis of the original ones, combined with a process of discretization of all feature values, can lead to an improvement of the performance related to the canonical algorithm of classification largely adopted in this field. This kind of feature engineering process was validated by using real-world data, and the experimental results indicate its effectiveness, regardless of the involved algorithms and the type of events taken into account.  
On the basis of the achieved improvements, the present work inspires some future research directions, in order to define additional intrusion detection approaches based on more sophisticated solutions, such as those based on hybrid-based or ensemble-based approaches, which involves more than a single algorithm of classification.  
As a final note, we would like to point out that we did not consider sophisticated data pre-processing techniques, since our objective is to demonstrate the LFE strategy capability to improve the baseline algorithms performance without computational efforts, as this effect suggests an ability to also improve more complex approaches. Part of our future research will be oriented in this direction, together with the adoption of other datasets that involve different network scenarios such as Internet of Things (IoT), Industrial Internet of Things (IIoT), Internet of Health Things (IoHT), and so on.  
Conceptualization, S.C., A.S.P., D.R.R. and R.S.; data curation, S.C., A.S.P., D.R.R. and R.S.; formal analysis, S.C., A.S.P., D.R.R. and R.S.; methodology, S.C., A.S.P., D.R.R. and R.S.; resources, S.C., A.S.P., D.R.R. and R.S.; supervision, S.C., A.S.P., D.R.R. and R.S.; writing--original draft, S.C., A.S.P., D.R.R. and R.S.; and writing--review and editing, S.C., A.S.P., D.R.R. and R.S. All authors have read and agreed to the published version of the manuscript.  
This research was partially funded and supported by \"Bando 'Aiuti per progetti di Ricerca e Sviluppo--POR FESR 2014-2020--Asse 1, Azione 1.1.3. Project IntelliCredit: AI-powered digital lending platform\" and Fondazione di Sardegna 2017 research project \"Algorithms for Approximation with Applications [Acube]\".  
The authors declare no conflict of interest.