# A Network Traffic Abnormal Detection Method: Sketch-Based Profile Evolution
## 4 Experiment and Result Analysis
The second part is the analysis experiment of the TG generation Profile, which is compared with PCA [54] and Basic Evolution [55], two algorithms for generating traffic characteristics. Among them, PCA converts the original data into a set of linearly independent vectors by finding the eigenvectors of the matrix. Basic Evolution divides the data flow by time, uses the size of network traffic as the feature of anomaly analysis, and, finally, uses SVD for anomaly detection. PCA is a widely used feature extraction method, and Basic Evolution has been proposed and proven to have a lower error rate in recent years. Therefore, we chose to compare SPE with them through experiments. This experiment uses a synthetic dataset [56] because it is difficult to perform artificial outlier analysis on real network traffic. Therefore, in the Mix3 dataset, points are randomly selected, and the order of the data packets is adjusted, or part of the data are replaced to obtain a synthetic dataset. The detection probability of outliers is used as an evaluation criterion, as shown in (29), where the number of outliers is detected correctly. \[DP\_TPR=\frac{N_{TP}}{N_{a}} \tag{29}\]  
The proportion of incorrectly detected non-abnormal points is used as another evaluation criterion, as shown in (30), where \(N_{FP}\) is the number of non-abnormal points detected by the algorithm and \(N_{DP}\) is the number of abnormal points detected by the algorithm:  
\[DP\_FPR=\frac{N_{FP}}{N_{DP}} \tag{30}\]  
Figure 9 shows the comparative experimental results of the three algorithms PCA, Basic Evolution, and SPE. Figure 9 suggests the outlier detection effects of the three algorithms PCA, Basic Evolution, and SPE. The detection probability of outliers and the proportion of non-outliers wrongly detected by the SPE algorithm are superior to the other two algorithms. With the increase in the number of outliers, the detection probability of outliers keeps increasing, while the proportion of non-outliers wrongly detected keeps decreasing. When the number of outliers reaches a certain size, the percentage of non-outliers varies very little between Basic Evolution and SPE, while the SPE algorithm continues to decrease, so the ability of the SPE algorithm to detect the percentage of non-outliers in error is far superior to the other two algorithms. Since the position of the abnormal point is random, the \(DP\_TPR\)  
Figure 9: Outlier detection comparison. and \(DP\_FPR\) of different abnormal points will change, which suggests that the abnormal position will affect the detection effect. The third part is the influence of Profile Evolution parameters on outlier detection. A total of 100 outliers are selected and the value is between [0.1, 1]. The results of each experiment are measured using the value of \(DP\_TPR\). The results of the experiments are shown in Figure 10:  
The result of anomaly detection is affected by the value of \(\varphi\). According to the Equation (23), \(d(b^{(n+1)})\) is the result generated by the new data stream, so the value \(\varphi\) determines the impact of the new data stream on the Profile. When the value \(\varphi\) is small, the impact of the new data stream on the Profile is relatively small, and when the value \(\varphi\) is large, the Profile will approximate the behavior of the new data stream. As shown in Figure 10, when \(\varphi\) = 0.6, the value of \(DP\_TPR\) is the largest, and the effect is the best for the selected 100 outliers. In reality, the behavior of a new data stream is subject to change, and the value of \(\varphi\) should be selected according to the actual situation.