# Data-Driven Network Anomaly Detection with Cyber Attack and Defense Visualization
## 5 Results and Performance Evaluation
For any related model that did not specify the percentage of attack dataset used in their implementation, we applied the full attack dataset, and we applied the same to our FREC-NIDS, while following revisions on the dataset given by [61]. By invoking 100% of the dataset, we demonstrated the replicability of implementing FREC-NIDS to real-world attack datasets without selecting which parts of the datasets can apply. Depending on the cost of FN, recall is essential as a consideration of attacks incorrectly predicted as benign. However, the weighted average (or harmonic mean) of precision and recall, calculated as the \(F_{1}\) score, provides a better overall performance balance. We obtain \(F_{1}\) score as:  
\[F_{1}Score=2\times\left(\frac{Precision\times Recall}{Precision+Recall}\right) \tag{23}\]  
Figure 5 summarizes the \(F_{1}\) score results, where FREC-NIDS starts with an \(F_{1}\) of 96.8% and ends with a high value of 97.9%. Multi-level hybrid SVM [18] finished closest to FREC-NIDS with 96.4% but having started with a low value of 88.6%. Actually, most models compared in our experiment started with a low performance score, possibly because of the required extensive training. Our network model, shown in Section 4.4, is a complex network model to subject all related models, as well as FREC-NIDS, to a robust experiment. Ruan et al. [16] start the experiment with the worst performance, followed by Hierarchical SOM [17] and Velliangiri [19], having performance scores between 89% and 95%. The difference in performance between Bagged C5 and the other related models [15, 16, 17, 18, 19] is possibly due to the different classifiers from multiple decision trees. Notably, although we used the full KDDCUP'99 dataset, FREC-NIDS achieved better results. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multicolumn{2}{c}{**Packets**\%} & \multicolumn{2}{c}{**Performance**} \\ \cline{2-5}  & **DoS** & **Probe** & **Precision** & **Recall** \\ \hline AdaBoost-based [15] & 100 & 100 & 0.922 & 0.956 \\ \hline Ruan et al. [16] & N/A * & N/A * & 0.895 & 0.894 \\ \hline Hierarchical SOM [17] & 96.90 & N/A * & 0.857 & 0.954 \\ \hline Multi-Level Hybrid & & 98.13 & 99.54 & 0.981 & 0.949 \\ SVM and ELM [18] & & & & \\ \hline Velliangiri [19] & N/A * & N/A * & 0.990 & 0.921 \\ \hline FREC-NIDS & 100 & 100 & 0.997 & 0.963 \\ \hline \hline \end{tabular}
* Not specifically mentioned in that research.  
\end{table} 
Table 2: Performance comparison to related works using the KDDCUP’99 dataset. The core objective of our research was articulated through MO-1 in Section 1, aiming at presenting a low-cost and straightforward technique for dynamic network data extraction then significantly enhancing network anomaly detection. Our findings in Section 5, demonstrating an \(F_{1}\) score of 97.9% and a minimal false positive rate of 0.3%, not only corroborate the achievement of this objective but also represent a critical step in network security. These outcomes directly address the prevailing challenges highlighted by Ferrag et al. [1] and Chowdhury & Gkiouolos [2], where traditional NIDS often lag in adapting to the fast-evolving cyber threats. Our approach for MO-1 further elaborated in Section 4 utilizes open-source tools for network data extraction, coupled with a data analytics-based intrusion detection system, which enables us to achieve MO-2 by ensuring replicabil  
Figure 4: True and false positive rates comparison. Figure 5: \(F_{1}\) score compared to other models [15, 16, 17, 18, 19]. ity and operational efficiency without necessitating extensive training data or bespoke closed-source solutions.