# Model Retraining upon Concept Drift Detection in Network Traffic Big Data
## 5 Experimentation Including the Results and Discussion
### Retraining the Model
#### 5.6.1 Testing Statistical Significance  
To test the statistical significance, the \(Z\)-test was used. Any two proportions can be statistically tested for significance using the \(Z\)-test. The formula for the \(Z\)-test statistic is provided by the following:  
\[Z=(\hat{p}_{1}-\hat{p}_{2})/\sqrt{\hat{p}_{1}(1-\hat{p}_{1})/n_{1}+\hat{p}_{2} (1-\hat{p}_{2})/n_{2}} \tag{8}\]  
where \(\hat{p}_{i}\) denotes the estimated \(i\)-th proportion, along with the corresponding sample size, \(n_{i}\), \(i=1,2\) for this estimation. Any \(Z\)-value greater than the threshold value \(z_{0,025}=1.96\) confirms the significant difference between the two proportions at a 95% confidence level.  
\begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Batch**} & \multirow{2}{*}{
\begin{tabular}{c} **Total** \\ **Records** \\ \end{tabular} } & \multirow{2}{*}{**Accuracy**} & \multirow{2}{*}{**Precision**} & \multirow{2}{*}{**Recall**} & \multicolumn{2}{c}{**F1-Score**} & \multirow{2}{*}{**FN**} & \multirow{2}{*}{**FP**} & \multirow{2}{*}{**TN**} & \multirow{2}{*}{**FP**} & \multicolumn{2}{c}{**Run**} \\  & & & & & & & & & & **Times (s)** \\ \hline
1 & 213 & 91.58\% & 100\% & 89.76\% & 94.60\% & 17 & 149 & 36 & 0 & 10.90 \\ \hline
2 & 146 & 87.02\% & 99\% & 85.32\% & 91.63\% & 16 & 93 & 21 & 1 & 7.91 \\ \hline
3 * & 116 & 85.05\% & 100\% & 83.75\% & 91.16\% & 13 & 67 & 7 & 0 & 7.25 \\ \hline
4 & 88 & 87.14\% & 100\% & 86.15\% & 92.56\% & 9 & 56 & 5 & 0 & 7.30 \\ \hline
5 & 71 & 88.16\% & 100\% & 86.76\% & 92.91\% & 9 & 59 & 8 & 0 & 7.84 \\ \hline
6 & 58 & 91.04\% & 100\% & 90.63\% & 95.08\% & 6 & 58 & 3 & 0 & 7.67 \\ \hline
7 & 76 & 92.65\% & 100\% & 92.42\% & 96.06\% & 5 & 61 & 2 & 0 & 6.27 \\ \hline
8 & 97 & 90.91\% & 100\% & 90.91\% & 95.24\% & 10 & 100 & 0 & 0 & 7.19 \\ \hline
9 & 119 & 95.63\% & 100\% & 95.60\% & 97.75\% & 7 & 152 & 1 & 0 & 6.76 \\ \hline
10 & 156 & 95.51\% & 100\% & 95.45\% & 97.67\% & 8 & 168 & 2 & 0 & 6.08 \\ \hline Averages & & 90.47\% & 99.90\% & 89.68\% & 94.47\% & & & & & \\ \hline \hline \end{tabular}  
* Incremental retraining starts.  
\begin{tabular}{c} **Accuracy** Before and After Retraining \\ \hline
120.00\% \\
100.00\% \\
60.00\% \\
40.00\% \\
20.00\% \\
0.00\% \\
1 2 3 4 5 6 7 8 9 10 \\ Accuracy After Retraining \\ \hline \end{tabular}  
\end{table}
Table 13: Performance metrics after incremental retraining.  
Figure 7: Accuracy before and after retraining.  
To test if there was a significant statistical difference in the accuracy before and after retraining, the \(Z\)-test was used. As demonstrated in Table 14, the \(Z\)-values before and after retraining were significantly different. After retraining, the accuracy was significantly higher. After batch 3, the \(Z\)-value started falling, so retraining was triggered, which resulted in a significant improvement in the statistical metrics. The positive \(Z\)-value means that the first value was significantly higher than the second value and the negative \(Z\)-value means that the second value was significantly higher than the first value.  
Table 15 presents the \(Z\)-value of the accuracy between each of the batches after retraining (Table 13). Here, too, there was a drop on batch 3; hence, incremental retraining was started on batch 3, after which the accuracy gradually increased significantly.