# One-Class LSTM Network for Anomalous Network Traffic Detection
## 5 Experimental Results and Discussion
### One-Class Classification on MAWILab  
In the field of network security, people are mostly inclined to effectively detect anomalous traffic in large-scale networks in order to ensure privacy and security. In this experiment, we examined the performances of the proposed algorithms in detecting original network traffic. We considered the raw network traffic dataset MAWILab, for which we performed a series of preprocessing and feature engineering steps to obtain 109-dimensional structured data. The experiment was performed on two data subsets separated by one year to measure the models' abilities to detect highly variable network anomalies. The ratio of the number of samples in the training set to the number of samples in the test set was nine to one, and the test set comprised anomaly instances with normal samples for the sake of having balanced data. Note that due to the large amount of data in the training set, the shallow baseline \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Method**} & \multicolumn{2}{c}{**CIC-DDoS**} & \multicolumn{2}{c}{**CIC-PortScan**} \\ \cline{2-5}  & **AUROC** & **AUPRC** & **AUROC** & **AUPRC** \\ \hline OC-SVM/SVDD & 66.46 \(\pm\) 0.90 & 61.56 \(\pm\) 0.79 & 71.92 \(\pm\) 0.08 & 62.32 \(\pm\) 0.06 \\ IF & 90.75 \(\pm\) 1.92 & 84.95 \(\pm\) 2.35 & 74.64 \(\pm\) 5.42 & 67.11 \(\pm\) 4.74 \\ KDE & 92.81 \(\pm\) 0.34 & 89.78 \(\pm\) 0.69 & 74.98 \(\pm\) 0.20 & 67.79 \(\pm\) 0.15 \\ DCAE & 90.62 \(\pm\) 2.51 & 89.10 \(\pm\) 5.12 & 94.75 \(\pm\) 4.29 & 90.62 \(\pm\) 7.37 \\ OC-NN & 99.07 \(\pm\) 0.26 & 98.90 \(\pm\) 0.41 & 98.53 \(\pm\) 0.71 & 97.35 \(\pm\) 1.48 \\ Soft-Bound Deep SVDD & 95.94 \(\pm\) 2.83 & 96.56 \(\pm\) 1.93 & 88.49 \(\pm\) 7.78 & 82.47 \(\pm\) 9.59 \\ One-Class Deep SVDD & 97.59 \(\pm\) 1.12 & 97.22 \(\pm\) 0.92 & 85.50 \(\pm\) 4.91 & 79.25 \(\pm\) 6.20 \\ OC-LSTM & **99.24 \(\pm\) 0.14** & **99.15 \(\pm\) 0.16** & **99.66 \(\pm\) 0.19** & **99.07 \(\pm\) 0.39** \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Average AUROC and AUPRC as percentages with StdDevs per method on CIC-IDS2017. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \begin{tabular}{c} **Anomaly** \\ **Class** \\ \end{tabular} & \begin{tabular}{c} **OC-SVM/** \\ **SVDD** \\ \end{tabular} & **IF** & **KDE** & **DCAE** & **OC-NN** & \
\begin{tabular}{c} **Soft-Bound** \\ **Deep SVDD** \\ \end{tabular} &
\begin{tabular}{c} **One-Class** \\ **Deep SVDD** \\ \end{tabular} & **OC-LSTM** \\ \hline DoS & 93.65 \(\pm\) 0.04 & 96.19 \(\pm\) 0.43 & 95.76 \(\pm\) 0.00 & 91.31 \(\pm\) 1.88 & 94.11 \(\pm\) 0.39 & 94.45 \(\pm\) 1.70 & 94.95 \(\pm\) 1.32 & **96.42 \(\pm\) 0.37** \\ Probe & 82.16 \(\pm\) 0.18 & **96.08 \(\pm\) 0.74** & 90.13 \(\pm\) 0.01 & 78.88 \(\pm\) 6.36 & 87.97 \(\pm\) 1.37 & 82.28 \(\pm\) 4.78 & 83.27 \(\pm\) 1.94 & 91.38 \(\pm\) 0.96 \\ R2L & 20.14 \(\pm\) 0.09 & 46.14 \(\pm\) 3.00 & 50.80 \(\pm\) 0.06 & 28.00 \(\pm\) 5.10 & 59.13 \(\pm\) 2.97 & 66.34 \(\pm\) 5.56 & **66.82 \(\pm\) 8.01** & 65.18 \(\pm\) 3.84 \\ U2R & 7.83 \(\pm\) 0.06 & 24.42 \(\pm\) 3.56 & 24.42 \(\pm\) 0.04 & 7.20 \(\pm\) 2.20 & 21.68 \(\pm\) 3.28 & 16.34 \(\pm\) 4.13 & 15.57 \(\pm\) 4.10 & **42.24 \(\pm\) 5.98** \\ Total & 89.77 \(\pm\) 0.03 & 95.73 \(\pm\) 0.22 & 95.20 \(\pm\) 0.00 & 88.90 \(\pm\) 3.45 & 95.07 \(\pm\) 0.25 & 95.51 \(\pm\) 1.04 & 95.71 \(\pm\) 0.53 & **96.72 \(\pm\) 0.34** \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Average AUPRC values as percentages with StdDevs per method on NSL-KDD. models could not complete the training process in a reasonable time frame. Therefore, we randomly sampled the training set again and selected 10% of the data for the training of the shallow baseline models. This also reflects the superiority of the deep anomaly detection methods, that is, they can handle a large amount of complex data. Table 5 presents the AUROC and AUPRC scores obtained by the various methods.