## 6 Experimental Setup  
This section describes the experimental framework used for assessing the impacts of imbalanced and passive adversarial learning on the PCA- and oSVM-based AMiDS models using four categories of data-level sampling methods. Consequently, we devised two experiments for each AMiDS, each consisting of four sub-experiments spanning the four categories of the data-level sampling methods. The four sub-experiments collectively covered eleven experimental runs, one for each selected data sampling and resampling method for imbalanced learning. While generative methods, such as autoencoders, usually \begin{table}
\begin{tabular}{l l l l} \hline \hline
**ID** & **Feature** & **Type** & **Description** \\ \hline
1 & pkSeqID & Number & Row Identifier \\ \hline
2 & Stime & Time & Record start time \\ \hline
3 & flgs & String & Flow state flags seen in transactions \\ \hline
4 & proto & String & Textual representation of transaction protocols present in network flow \\ \hline
5 & saddr & IP address & Source IP address \\ \hline
6 & sport & Number & Source port number \\ \hline
7 & daddr & IP address & Destination IP address \\ \hline
8 & dport & Number & Destination port number \\ \hline
9 & pkts & Number & Total count of packets in transaction \\ \hline
10 & bytes & Number & Total number of bytes in transaction \\ \hline
11 & state & String & Transaction state \\ \hline
12 & lime & Time & Record last time \\ \hline
13 & seq & Number & Argus sequence number \\ \hline
14 & dur & Number & Record total duration \\ \hline
15 & mean & Number & Average duration of aggregated records \\ \hline
16 & stddev & Number & Standard deviation of aggregated records \\ \hline
17 & sum & Number & Total duration of aggregated records \\ \hline
18 & min & Number & Minimum duration of aggregated records \\ \hline
19 & max & Number & Maximum duration of aggregated records \\ \hline
20 & spkts & Number & Source-to-destination packet count \\ \hline
21 & dpkts & Number & Destination-to-source packet count \\ \hline
22 & sbytes & Number & Source-to-destination byte count \\ \hline
23 & dbytes & Number & Destination-to-source byte count \\ \hline
24 & rate & Number & Total packets per second in transaction \\ \hline
25 & srate & Number & Source-to-destination packets per second \\ \hline
26 & date & Number & Destination-to-source packets per second \\ \hline
27 & label & Number & Class label: 0 for Normal traffic, 1 for Attack Traffic \\ \hline
28 & category & String & Traffic category \\ \hline
29 & subcategory & String & Traffic subcategory \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Features of the PiB dataset. train autoencoders on one class, i.e., the majority class, we trained two autoencoders for each class, similar to the study in [58]. We designed the experiments using the Microsoft Azure Machine Learning Studio (MS AMLS) platform. We built the models in Python using Azure Notebook, Azure ML curated environments and a Linux-based computer with four cores, 8 GB RAM, and 32 GB of storage. To build the PCA-based AMiDS model, we used the PCA anomaly detection module from the azureml-designer-classic-modules 0.0.176 package [74]. At the time of writing this paper, the current version of the azureml-designer-classic-modules is 0.0.177. However, we used the OneClassSVM from sklearn to build the oSVM-based AMiDS model due to the discontinuation of oSVM from Azure ML studio. Additionally, we used the imbalanced-learn packages version 0.9.1, which contains the oversampling methods, and version 0.1.1, which contains the two ensemble-based methods used by this study. We used these ensemble-based methods even though the developer disapproves of them, according to to [75] either in favor of meta-estimators or algorithm-level methods that use boosting rules. This may be because these deprecated methods are mainly data samplers. For the LoRAS oversampling method, we used the pylas package, version 0.1.0b5.