# Model Retraining upon Concept Drift Detection in Network Traffic Big Data
## 5 Experimentation Including the Results and Discussion
### Retraining the Model
#### 5.6.2 Incremental Retraining or Full Retraining? As shown in Table 13, incremental retraining starts on batch 3; that is, starting with batch 3, the model is retrained. Incremental training, while useful for certain applications, gradually integrates new data without completely discarding past knowledge. Incremental retaining assumes that the data distribution does not shift significantly over time. Table 13 shows that, as the batches progress, more data points are being utilized for retraining, \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **First Batch** & **Second Batch** & **Z-Value** \\ \hline
1 & 0.9158 & 0.8702 & 38.37009294 \\ \hline
2 & 0.8702 & 0.8505 & 14.74603031 \\ \hline
3 & 0.8505 & 0.8714 & \(-\)15.6717524 \\ \hline
4 & 0.8714 & 0.8816 & \(-\)8.03994758 \\ \hline
5 & 0.8816 & 0.9104 & \(-\)24.4902063 \\ \hline
6 & 0.9104 & 0.9265 & \(-\)15.2602768 \\ \hline
7 & 0.9265 & 0.9091 & 16.4353907 \\ \hline
8 & 0.9091 & 0.9563 & \(-\)49.0737006 \\ \hline
9 & 0.9563 & 0.9551 & 1.512600601 \\ \hline
10 & 0.9551 & & \#DIV/0! \\ \hline \hline \end{tabular}
\end{table} 
Table 15: \(Z\)-value between each of the batches after retraining. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Accuracy Before** & **Accuracy After** & **Z-Value** \\  & **Retraining** & **Retraining** & **Z-Value** \\ \hline
1 & 0.9249 & 0.9158 & 8.720846 \\ \hline
2 & 0.8973 & 0.8702 & 21.94895 \\ \hline
3 & 0.9052 & 0.8505 & 43.47297 \\ \hline
4 & 0.875 & 0.8714 & 2.805536 \\ \hline
5 & 0.9014 & 0.8816 & 16.51604 \\ \hline
6 & 0.8103 & 0.9104 & \(-\)75.6705 \\ \hline
7 & 0.7895 & 0.9265 & \(-\)103.792 \\ \hline
8 & 0.7938 & 0.9091 & \(-\)85.1988 \\ \hline
9 & 0.7899 & 0.9563 & \(-\)133.898 \\ \hline
10 & 0.7372 & 0.9551 & \(-\)164.316 \\ \hline \hline \end{tabular}
\end{table} 
Table 14: \(Z\)-value before and after retraining. suggesting that the model is adapting over time by incorporating more new data. While incremental training is efficient and allows for real time updates, it struggles to recover from significant drift, especially when the new data distribution differs from the original training set. Full retraining, although more resource-intensive, ensures that the model is optimized for the current data. The decision to retrain fully rather than incrementally is driven by the need for a robust anomaly detection system that can reliably adapt to evolving threats, maintaining high precision and recall rates while minimizing false negatives. When performance drops below a predefined threshold, such as accuracy falling below 80%, full retraining is triggered. Hence, as per Table 11, full retraining would trigger at batch 7. Full retraining would be performed with all the original data plus all batches up to and including batch 7, with the usual 80/20 split for training/testing. This would ensure that the model resets its learned patterns and adapts to the most recent distribution of normal and anomalous data. Table 16 presents our results after full retraining. The results from the experimental setup demonstrate the effectiveness of the Isolation Forest model in detecting anomalies across varying levels of concept drift. As observed in the comparative performance in Tables 11 and 13, the model maintains high precision across all batches in Table 13, consistently achieving a precision score of 1.0. This indicates that the model is highly confident in its positive classifications, with minimal false positives. However, as the proportion of injected anomalous data increases, a decline in accuracy, recall, and F1-score can be observed, as shown in Table 11.  
The comparison between the two tables before and after retraining (Tables 11 and 13, respectively) reveals several noteworthy trends in the model's performance over time. Initially, accuracy showed a clear decline, dropping from 92.49% to 73.72% before retraining, but after retraining, the accuracy went from 91.58% to 95.51%. It can also be noted that the average accuracy was also higher after the retraining.