# Multi-Resolution Analysis with Visualization to Determine Network Attack Patterns
## 6 Results and Discussion  
When applying the DWT with various wavelet functions and levels, different numbers of instances and features are generated. Statistical validation is performed to determine significant features (\(p<0.01\)) and reduce computational time while maintaining high accuracy. For analyzing the NSLKDD dataset with Daubechies 3 (db3) with \(\alpha=150\) and \(\beta=30\), a total of 4929 data instances with 572 features were determined. Under the same parameter setting with Daubechies 5 (db5), we found the same data instances (i.e., 4929) with a much larger number of features (i.e., 667). Similar results were also observed under the same parameter setting in Kyoto2006 (db3: instances = 12,694 and features = 292/db5: instances = 12,694 and features = 334) and CICIDS2017 (db3: instances = 14,850 and features = 1058/db5: instances = 14,850 and features = 1439). Figure 2 shows the average number of features and instances generated with different wavelets, window (\(\alpha\)), and step (\(\beta\)) sizes. As the window size increases, the overall number of significant DWT features increases as well (see Figure 2A-C). However, only minor changes in the number of features were observed with increased step sizes. One interesting result we found with the NSLKDD dataset was that the number of features showed a decreasing pattern when the step size increased up to 100. After the value of 100, the number of features started to increase slowly. We found a fluctuation  
Figure 2: The number of determined DWT attributes and instances \(\pm\) SEM depending on the window (a) and step (\(\beta\)) sizes. \(x\)-axis indicates the size of either \(\alpha\) or \(\beta\). (**A**) NSLKDD; (**B**) Kyoto2006; (**C**) CICIDS2017; (**D**) NSLKDD; (**E**) Kyoto2006; (**F**) CICIDS2017. in the number of features with increased window sizes in the Kyoto2016 dataset. For the CICIDS2017 dataset, we identified a gradual change (slowly increased and decreased pattern) as the window size increased. On the other hand, when the step size was increased, we found a continuously increasing pattern for all datasets. We also found that there was a high variation in the number of features, especially when the step size was small (e.g., \(\beta=20\)). This would be because the determined number of features might have a high variance depending on the applied wavelet function. For example, coif5 produces more features than coif1 or coif3 as the wavelet function is stretched to capture multiple frequency components at different locations of the data. By evaluating the number of instances, we determined that the size of the instances decreased if either window or step size decreased. With a small window and step size, numerous features were generated and determined as significant features. We determined that using a small step size would be beneficial for analyzing the data because it generated a large number of instances, which eventually might help train and build predictive models for detecting network attacks. We also performed an extensive evaluation of the datasets to determine optimal parameters (i.e., sliding window and step sizes) for analyzing the data with visualization. Various window (\(\alpha\)) and step (\(\beta\)) sizes ranging from 20 to 300 and 10 to 290, respectively, were tested to examine the effect of different window and step values on the classification performances. For a fair comparison, the evaluation was managed under the condition of having a fixed value for the sliding window or the step size. Figure 3 shows visualizations with different window sizes under the same step size \(\beta=10\). We found that when a small window size was used (i.e., \(\alpha<=100\)), it was difficult to separate normal and attack events clearly. For instance, most normal and attack events lay within the same local region (see Figure 3G). Similarly, we did not observe a clear separation in the CICIDS2017 dataset (see Figure 3H-L). One interesting result was that all attack events appear at the bottom of the projection space.