# AE-CGAN Model based High Performance Network Intrusion Detection System
## 6 Experiment and Results
### Comparison with Other Data Imbalanced Resolution Algorithms  
In previous studies, SMOTE techniques have often been used to address the problem of data imbalance. Therefore, we compared the performance of the SMOTE-RF model, which classifies oversampled data as RF using the SMOTE technique, and the AE-CGAN-RF model proposed in this study. In addition, the feature was extracted with AE, oversampled with SMOTE, and compared with AE-SMOTE-RF. This is to check whether the vector extracted by AE is well oversampled in SMOTE.  
As shown in Figure 7, the performance of the proposed AE-CGAN-RF model is higher than that of SMOTE-RF and AE-SMOTE-RF.  
SMOTE is a method of creating virtual fractional class data on a straight line between the fractional class data and the randomly selected data among closest to the data. SMOTE works by adding points that are moved slightly in consideration of nearest neighbors. If other classes are adjacent, the other classes are overlapped. As a result, data imbalance cannot be completely solved. However, the CGAN proposed in this study shows that the effect of oversampling can be maximized because the data is replicated similarly by the generation algorithm. In addition, the AE-SMOTE-RF model has lower performance than the SMOTE-RF, and the data reduced by AE are not suitable for the model that moves exact points like SMOTE.  
\begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Type**} & \multicolumn{4}{c}{**Precision**} & \multicolumn{4}{c}{**Recall**} & \multicolumn{4}{c}{**F1 Score**} \\ \cline{2-10}  & **Single-RF** & **AE-RF** & **AE-CGAN-RF** & **Single-RF** & **AE-RF** & **AE-CGAN-RF** & **Single-RF** & **AE-RF** & **AE-CGAN-RF** \\ \hline Benign & 99.62 & 99.76 & 99.92 & 99.52 & 99.59 & 99.91 & 99.57 & 99.67 & 99.92 \\ \hline DDoS & 99.98 & 99.91 & 99.99 & 99.86 & 99.74 & 99.92 & 99.92 & 99.82 & 99.96 \\ \hline Port Scan & 98.52 & 94.75 & 99.38 & 99.89 & 97.35 & 99.96 & 99.20 & 96.03 & 99.67 \\ \hline Bot & 100.00 & 85.76 & 83.69 & 20.69 & 66.92 & 54.41 & 34.29 & 55.89 & 65.94 \\ \hline Infiltration & 100.00 & 100.00 & 100.00 & 40.00 & 13.33 & 66.67 & 57.14 & 42.82 & 80.00 \\ \hline Web Attack & 99.62 & 99.06 & 99.40 & 91.40 & 96.56 & 94.84 & 95.33 & 97.79 & 97.07 \\ \hline FTP-Patator & 100.00 & 99.97 & 100.00 & 99.50 & 99.84 & 99.84 & 99.75 & 99.91 & 99.92 \\ \hline SSH-Patator & 100.00 & 99.66 & 100.00 & 99.81 & 98.94 & 99.75 & 99.40 & 99.30 & 99.87 \\ \hline DoS Goldenberg & 95.73 & 99.20 & 99.42 & 97.55 & 98.98 & 99.44 & 96.63 & 99.09 & 99.43 \\ \hline DoS Hulk & 95.33 & 99.67 & 99.63 & 96.73 & 99.84 & 99.73 & 96.03 & 99.75 & 99.68 \\ \hline DoS & & & & & & & & & \\ Slowhttplest & 88.22 & 99.05 & 99.00 & 79.00 & 99.00 & 89.95 & 83.36 & 99.02 & 98.98 \\ \hline Dof Slowloris & 99.55 & 99.48 & 99.61 & 85.38 & 99.31 & 99.31 & 91.92 & 99.40 & 99.46 \\ \hline Heartbleed & 100.00 & 100.00 & 100.00 & 80.00 & 80.00 & 100.00 & 88.78 & 88.89 & 100.00 \\ \hline
**Average** & **98.20** & **98.17** & **98.46** & **83.79** & **88.42** & **93.29** & **87.79** & **90.57** & **95.38** \\ \hline \hline \end{tabular}
\end{table}
Table 4: Performance comparison of single-RF, AE-RF, and AE-CGAN-RF.