# Model Retraining upon Concept Drift Detection in Network Traffic Big Data
## 5 Experimentation Including the Results and Discussion
### Drift Detection  
As shown in Figure 4c, as the data starts drifting, the Isolation Forest algorithm is used to identify changes in the data distribution that might impact the model's performance. Isolation Forest does this by detecting anomalies in new incoming data by calculating drift metrics. This is performed by tracking changes in anomaly scores across the different batches and determining if a drift occurred. The Baseline Anomaly Rate, New Anomaly Rate, and Drift Factor, that is, Equations (5), (6), and (7), respectively, play a crucial role in determining what would be considered a concept drift in a model. The Baseline Anomaly Rate (Equation (5)), which is the number of anomalies in the original test data to the total number of instances in the test data, establishes a reference point. That is, anything higher than the Baseline Anomaly Rate would be considered anomalous data. As presented in Table 12, in this work, the baseline anomaly rate was set to 0.03 in all batches. This rate tells the model that 0.03 or 3% of all records are allowed to be anomalous. The usual standard used for a baseline anomaly rate is between 0.01 and 0.05. A higher rate leads to missing alerts, and a lower rate leads to overwhelming the alerts for the security system; 0.03 falls right in the middle. \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Batch**} & \multirow{2}{*}{
\begin{tabular}{c} **Total** \\ **Records** \\ \end{tabular} } & \multirow{2}{*}{**Accuracy**} & \multirow{2}{*}{**Precision**} & \multirow{2}{*}{**Recall**} & \multirow{2}{*}{**F1**} & \multirow{2}{*}{**FN**} & \multirow{2}{*}{**TP**} & \multirow{2}{*}{**TN**} & \multirow{2}{*}{**FP**} & \multirow{2}{*}{**Run Times (s)**} \\ \hline
1 & 213 & 92.49\% & 0.9941 & 91.85\% & 95.48\% & 18 & 148 & 36 & 0 & 10.78 \\ \hline
2 & 146 & 89.73\% & 100\% & 88.28\% & 93.78\% & 12 & 97 & 21 & 1 & 7.68 \\ \hline
3 & 116 & 90.52\% & 100\% & 89.52\% & 94.47\% & 14 & 66 & 7 & 0 & 7.66 \\ \hline
4 & 88 & 87.50\% & 100\% & 86.08\% & 92.52\% & 7 & 58 & 5 & 0 & 7.39 \\ \hline
5 & 71 & 90.14\% & 100\% & 89.06\% & 94.21\% & 16 & 52 & 8 & 0 & 7.63 \\ \hline
6 & 58 & 81.03\% & 100\% & 80.36\% & 89.11\% & 12 & 52 & 3 & 0 & 7.21 \\ \hline
7 & 76 & 78.95\% & 100\% & 78.67\% & 88.06\% & 17 & 49 & 2 & 0 & 6.22 \\ \hline
8 & 97 & 79.38\% & 100\% & 79.38\% & 88.51\% & 36 & 74 & 0 & 0 & 7.05 \\ \hline
9 & 119 & 78.99\% & 100\% & 78.99\% & 88.27\% & 50 & 109 & 1 & 0 & 6.49 \\ \hline
10 & 156 & 73.72\% & 100\% & 73.38\% & 84.64\% & 58 & 118 & 2 & 0 & 5.89 \\ \hline Averages & & 84.25\% & 99.94\% & 83.56\% & 90.91\% & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 11: Detecting concept drift: performance metrics before retraining. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Batch Number**} & \multirow{2}{*}{ \begin{tabular}{c} **Baseline** \\ **Anomaly Rate** \\ \end{tabular}  } & \multirow{2}{*}{\ \begin{tabular}{c} **Anomaly** \\ **Score** \\ \end{tabular}  } & \multirow{2}{*}{ \begin{tabular}{c} **New Anomaly** \\ **Rate** \\ \end{tabular}  } & \multirow{2}{*}{**Drift Factor**} \\ \hline
1 & 0.03 & 0.695162946 & 0.028173105 & 0.9391035 \\ \hline
2 & 0.03 & 0.699885789 & 0.057822131 & 1.92740436 \\ \hline
3 & 0.03 & 0.713253628 & 0.087895827 & 2.92986091 \\ \hline
4 & 0.03 & 0.687121205 & 0.118933493 & 3.9644  
The New Anomaly Rate (Equation (6)) captures the proportion of new anomalies to the total number of instances in the updated test data. As shown in Table 12, the new anomaly rate steadily grows with each new batch, indicating that the nature of the data is changing. If the new anomaly rate surpasses the baseline anomaly rate of 0.03, this signals that the model is seeing more unfamiliar patterns. This will trigger retraining. The Drift Factor (Equation (7)), which compares these two rates, the new anomaly rate to the baseline anomaly rate, determines the severity of the drift and its influence on the model's effectiveness.