## 5 Discussion  
The findings of Section 4.2, show that after feature selection optimization, one of the resulted subsets is a near-optimal subset, since it performs better than the original one when measured with precision. This near-optimal subset was generated after feature selection optimization by using BPSO, BMVO, BWOA, BFFA, BBAT optimizers.  
These results acknowledge that Swarm intelligence algorithms have high performance on feature selection optimization problems and can be used to enhance Machine Learning models. The use of bio-inspired models in our proposed system resulted in better precision value when utilized in the feature selection optimization process, before fitting the machine learning algorithm to the dataset.  
We compared our approach with approaches that used Hidden Markov Models (HMM), Damerau-Levenshtein (DL) Distance, Cosine Distance, and Jaccard Distance techniques (Table 9 reports the performance of each approach based on TP/FP detection rate).  
[PERSON] et al. [14] used HMM and reported an 85% identification rate with a false positive rate of 20%. [PERSON] et al. [15] acknowledge that during the training phase of HMM, the computational time can be quite slow, as the number of features increases. [PERSON] et al. [15] used HMM and distance measurement techniques and reported detection rates of 69% and 80% (aggregate score), respectively. The authors reported that HMM took more than 24 h to process all data, in opposition to distance measurements that took minutes to process. While the authors report that the combination of the three distance  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Experiment (\({}^{\text{1}}\))** & **Contaminatioflime\_Taken** & **TP** & **FP** & **FN** & **DR** & **Precision** \\ \hline
1 & 0.001 & 488 & 44.0 & 252.0 & 26.0 & 0.628571 & 0.148649 \\
2 & 0.002 & 516 & 58.0 & 339.0 & 12.0 & 0.828571 & 0.146096 \\
3 & 0.003 & 480 & 62.0 & 394.0 & 8.0 & 0.885714 & 0.135965 \\
4 & 0.004 & 488 & 63.0 & 414.0 & 7.0 & 0.9 & 0.132075 \\
5 & 0.005 & 481 & 64.0 & 421.0 & 6.0 & 0.914286 & 0.131959 \\ \hline \hline \end{tabular} \({}^{(\text{1})}\) In experiments 1-5 we utilized full data from logins, devices and files dataset files.  
\end{table}
Table 8: LOF results for subset of four (4) features.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Author** & **Approach** & **TP** & **FP** \\ \hline This paper & Table 8—Exp.5 & 91.4\% & 45\% \\ This paper & Table 8—Exp. 2 & 83\% & 36\% \\
[14] & HMM & 85\% & 20\% \\
[15] (\({}^{\text{1}}\)) & DL & 39\% & \\
[15] (\({}^{\text{1}}\)) & Jaccard & 36\% & \\
[15] (\({}^{\text{1}}\)) & Cosine & 47\% & \\
[15] (\({}^{\text{1}}\)) & DL, Jaccard \& Cosine aggregate score & 80\% \\
[15] (\({}^{\text{1}}\)) & HMM & 69\% & \\ \hline \hline \end{tabular} \({}^{(\text{1})}\) The authors report a potential of a high number of FP but do not mention the number of FP in their results.  
\end{table}
Table 9: Comparison with other approaches.  
measurements techniques has the potential of raising a high number of FP, they do not mention the number of FP of their results. While our approach reports a high number of FP, it also reports a better TP identification rate compared with other approaches, as reported in Table 9.