## 4 Results
### Testing the Model
The higher the value, the more objects will be predicted as anomalies. Since we had a high number of FP in the first run of the model (Table 5), we continued our experiments by reducing the value of contamination to reduce the number of FP. We changed the contamination value to 0.1, to get similar results when contamination was set to auto (results are shown in Table 6). The optimal subset remains the same, but precision value is still very low. By changing the contamination value to 0.01 we got slightly different results (shown in Table 7) compared with the previous two cases and, in this case, the better precision value is produced by experiment #2, with a subset dataset of five (5) features. This subset dataset was produced by all seven (7) algorithms during most of the algorithms' iterations. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Experiment (\({}^{\text{(1)}}\))** & **Features** & **Time\_Taken** & **TP** & **FP** & **FN** & **DR** & **Precision** \\ \hline
1 & 9.0 & 11.854724 & 70.0 & 925.0 & 0.0 & 1.00000 & 0. 070352 \\
2 & 5.0 & 6.610281 & 69.0 & 923.0 & 1.0 & 0.985714 & 0. 069556 \\
3 & 4.0 & 5.990587 & 65.0 & 837.0 & 5.0 & 0. 928571 & 0. 072062 \\
4 & 7.0 & 7.884163 & 70.0 & 925.0 & 0.0 & 1.00000 & 0. 070352 \\
5 & 6.0 & 8.453545 & 70.0 & 927.0 & 0.0 & 1.000000 & 0. 070211 \\ \hline \hline \end{tabular} \({}^{\text{(1)}}\) In all experiments, a portion of the original synthetic dataset was used to detect outliers.  
\end{table} 
Table 6: Local outlier factor (LOF) results with feature optimization. N_neighbors = 20 and contamination = 0.1. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Experiment (\({}^{\text{(1)}}\))** & **Features** & **Time\_Taken** & **TP** & **FP** & **FN** & **DR** & **Precision** \\ \hline
1 & 9.0 & 8.604782 & 70.0 & 918.0 & 0.0 & 1.00000 & 0.070850 \\
2 & 5.0 & 6.609488 & 69.0 & 910.0 & 1.0 & 0.985714 & 0.070480 \\
3 & 4.0 & 5.928126 & 62.0 & 774.0 & 8.0 & 0.885714 & 0.074163 \\
4 & 7.0 & 7.686987 & 70.0 & 918.0 & 0.0 & 1.00000 & 0.070850 \\
5 & 6.0 & 6.994491 & 69.0 & 919.0 & 1.0 & 0.985714 & 0.069838 \\ \hline \hline \end{tabular} \({}^{\text{(1)}}\) In all experiments, a portion of the original synthetic dataset was used to detect outliers.  
\end{table} 
Table 5: LOF results with feature optimization. N_neighbors = 20 and contamination = auto. We continued our experiments by tuning the contamination value in LOF and fitting the LOF algorithm on the optimized subset of four (4) features. In Table 8, the reported results indicate that, for the specific synthetic dataset, we can get better results with lower contamination values. The performance of an LOF algorithm depends on its parameters' values, contamination and neighborhood size [29]. When experimenting with synthetic data with the known anomaly portion, contamination value and neighborhood size can be tuned based on this known anomaly portion data and report better results. In a real-world scenario, these parameters can be tuned based on historic evidence of malicious insiders or use the [PERSON] et al. [29] methodology for automatic tuning Local Outlier Factor's hyperparameters.