# Multi-Resolution Analysis with Visualization to Determine Network Attack Patterns
## 5 Classification Analysis and Visualization  
To understand the effectiveness of MRA with visualization in network traffic data analysis, classification analysis was performed. In detail, Support vector machine (SVM), Naive Bayes (NB), and k-nearest neighbors (KNN) algorithms were used for performance comparison. SVM is a classification technique that constructs a separating hyperplane. Because of its effectiveness in classifying data, SVM has been used in numerous fields such as health [49], pattern recognition [50], and network traffic data analysis [51; 52; 53; 54]. KNN is a non-parametric supervised machine learning method that finds k nearest observations by calculating the distance between one observation and its k-nearest neighbors [55; 56]. KNN generally requires less computational time to predict the output, and it has been used in the applications such as health science [57; 58] and network traffic analysis [59; 60]. NB uses prior and posterior probabilities to classify data. It uses the relationships among attributes to train a model. Although several assumptions need to be defined in training (such as the data in each attribute following Gaussian distribution), it has been widely used because of strong performances in analyzing data in various domains such as bioinformatics [61], health science [62], network traffic analysis [63; 64]. To represent network traffic data, a coordinated multi-view (CMV) framework [65] is used to support multiple data analyses with different visualizations. The visualization includes two views, PCA Projection View and Data View. In the PCA Projection View, the first and second principal components are used to represent all network traffic data within a 2D display space (mapped to \(x\)- and \(y\)-axis, respectively). Each network event is represented as a rectangular-shaped glyph, and blue and red color attributes are used to indicate normal and attack events. It supports multiple user interaction techniques such as navigation, selection, and manipulation to help the user conduct visual analysis of the displayed network traffic data. Navigation techniques (including semantic zooming and panning) help the user navigate the PCA projection space freely. The Data View is designed to display two connected sub-views to represent normal and attack events separately by utilizing parallel coordinates. The parallel coordinates visualization [66]) shows the actual feature space of the network traffic data. In the view, each line indicates an individual network event. Therefore, a highly cluttered visual representation indicates that there are high variances in the data. Figure 1 presents visualizations of the different intrusion detection datasets using the original raw features (Figure 1A,C) and the selected DWT features (Figure 1D,F. The visualizations with the NSLKDD dataset (Figure 1A) and the Kyoto2006 dataset (Figure 1B) show minor differences between normal and attack events. Since the overall number of attack events in the Kyoto2006 dataset is very large compared to the normal events, they show a dispersion pattern in the PCA projection space. However, the visualization with the CICIDS2017 dataset (Figure 1C) presents a significant difference since it is an imbalanced  
dataset (only 12.5% indicates attack events). Because of the high similarity between normal and attack events, the attack events are not visible clearly in the PCA projection space. Figure 1D,F represent the visualizations with the DWT features. Differences between the raw and the DWT features are clear when comparing their PCA projections. The visualization with the NSLKDD dataset shows that a separated cluster representing normal events only appears in the bottom right corner (see Figure 1D). For the Kyoto2006 dataset, the difference between the two visualizations (Figure 1B,E) was not clear since the representations were highly cluttered. However, the Data View clearly shows a difference between normal and attack events.