## 4 Evaluation
### Comparison with the Latest Techniques
We consider node2 vec-AE as packet2 vec-AE without penalty, so node2 vec-AE is considered to be the worst case of the packet2 vec-AE algorithm. Figure 7 is a visualization of unsupervised intrusion detection algorithms. It can be seen from Figure 7 that the performance of the PCA algorithm is the worst. The PCA algorithm does not have the ability to accurately distinguish between five different types of network packets. Deep auto-encoder has the ability to accurately distinguish DDoS attacks, but it is difficult to accurately distinguish the other four types of network packets. The proposed node2 vec-AE algorithm has the ability to accurately distinguish between several types of network packets, including normal, Brute Force SSH attacks and DDoS attacks. The proposed packet2 vec-AE algorithm has the ability to accurately distinguish between five types of network packets. One possible explanation is that existing unsupervised intrusion detection algorithms only use the original features of the network packet as input. The features obtained by packet2 vec-AE and node2 vec-AE preprocessing include the original features of the network packet, and also include the local proximity features that characterize the similarity between network packets. Due to the increase of effective information in the preprocessed data, the accuracy of the proposed algorithm is higher than the existing three intrusion detection algorithms. From Table 14 and Figure 7, we can see that the accuracy and detection rate of node2 vec-AE is slightly lower than packet2 vec-AE. One possible explanation is that the node2 vec-AE algorithm does not constrain the local proximity sampling range of random walk. Therefore, the node2 vec-AE algorithm has a high probability of random walk to high-order proximity far from the source network packet. Finally, the proximity sampling of the source network packet does not have the ability to  
Figure 7: Visualization of unsupervised intrusion detection algorithms. (**a**) PCA algorithm. (**b**) Deep Auto-encoder algorithm. (**c**) Proposed node2 vec-AE algorithm. (**d**) Proposed packet2 vec-AE algorithm. accurately characterize the local proximity. However, the accuracy of the node2 vec-AE algorithm is higher than that of RBM, PCA, and deep auto-encoder. This shows that combining the original features of the network packet with the local proximity features that describe the similarity between network packets has the ability to achieve better intrusion detection performance. It also proves the effectiveness of our proposed algorithm. Table 14 contains some supervised algorithms, such as SVM-IDS 2017 [37], J48-IDS 2017 [38], and C4.5-IDS 2016 [39]. The performance of the SVM-IDS 2017 [37], J48-IDS 2017 [38], and C4.5-IDS 2016 [39] algorithms is for reference only. The algorithm we propose does not require performance comparisons with these three algorithms. The algorithm we propose is unsupervised, but the three algorithms are supervised. So this comparison is unfair. In intrusion detection, labels are difficult to obtain. The advantage of an unsupervised algorithm is that it can perform intrusion detection on all network traffic without being restricted by labels. For training and testing time, all of my experiments were able to run in 24 h under the server configuration shown in Table 13. The experiment of obtaining the local proximity features of the network packet using the Packet2 vec algorithm can be completed in 16 G memory within 12 h. The experimental time for intrusion detection using the extracted network packet characteristics as input to Deep Auto-encoder is within 1 h. The overall operating time is within an acceptable range. The ISCX 2012 dataset appeared later. Therefore, we could not find enough literature on training, testing time, and memory size, and we were not able to evaluate it [6].