## 4 Results
### Testing the Model  
The objective of the test is to improve the performance of the Machine learning model by obtaining the optimal subset, using Bio-inspired models, before fitting Local Outlier Factor (LOF) algorithm to it and determine the outliers. We created samples of the first 50,000 rows from the synthetic dataset, to work with a smaller portion of it, for performance reasons. Sample creation code is presented in Figure 2.  
Data collection and data pre-processing code execution take place in order to prepare the data frame with all selected features and fit the feature selection optimization to it. We fitted the feature selection optimization framework on the first thousand (1000) rows of the generated data, with the results shown in Table 4. The seven (7) columns represent the results for each optimizer from the selected, BPSO, BMVO, BGWO, BMFO, BWOA, BFFA and BBAT. Time taken is in seconds and is about the same for all seven optimizers. Train and testing accuracy are computed based on the sliced part for each value, as shown in Figure 3 and against the complete dataset. In order to test the feature selection output results if they generate an optimal subset, we need to fit LOF to the subset generated after the feature selection. The performance can be measured by comparing time taken for insider threat detection along with the detection rate and precision. Precision is the ratio of True Positives to the total number of positive results, Precision = TPP / (TP + FP), with \(1\) being the best value and \(0\) the worst. The first measurement is done by selecting all features (Figure 4), as generated after the pre-processing data phase, and see the results without feature selection optimization. Following this, we run more experiments based on the results of feature selection optimization. The results of the experiments are presented in Table 5. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & **BPSO** & **BMVO** & **BGWO** & **BMFO** & **BWOA** & **BFFA** & **BBAT** \\ \hline Time Taken [1] & 9.4016 & 11.3000 & 8.8428 & 8.5710 & 12.0246 & 10.5799 & 9.3706 \\ Train Accuracy [1] & 0.9985 & 0.9939 & 0.9939 & 0.9939 & 0.9939 & 0.9939 & 0.8030 \\ Test Accuracy [1] & 0.9941 & 1 & 1 & 1 & 1 & 0.8235 \\ Number of & \(7\times 4\) Feat. & \(2\times 4\) Feat. & & \(2\times 4\) Feat. & \(3\times 4\) Feat. & \(5\times 4\) Feat. \\ Iterations x Features & \(4\times 5\) Feat. & \(15\times 5\) Feat. & \(0\times 4\) Feat. & \(0\times 4\) Feat. & \(15\times 5\) Feat. & \(14\times 5\) Feat. \\ Selected [1] & \(2\times 6\) Feat. & \(2\times 6\) Feat. & \(19\times 5\) Feat. & \(19\times 5\) Feat. & \(3\times 6\) Feat. & \(0\times 6\) Feat. & \(8\times 5\) Feat. \\  & \(4\times 7\) Feat. & & & \(3\times 6\) Feat. & \(3\times 7\) Feat. & \\ \hline \hline \end{tabular} \({}^{(1)}\) Results of a single independent run executed for each algorithm.  
DatasetSplitRatio=0.34#Training66%, Testing34%  
\end{table} 
Table 4: Feature selection optimization results. Figure 3: Training % | Testing %. Figure 2: Create samples from the synthetic dataset. The results of Table 5 show a high detection rate but very low precision, since we have a high number of FP. We can experiment with the parameters of LOF algorithm and change n_neighbors and contamination values to see whether we can get improved precision results. In order to get the results in Table 5, n_neighbors' value was set to 20 and contamination set to auto. The performance of LOF is highly dependent on the values of contamination and n_neighbors [29]. We set the value of n_neighbors to 20, which is the default value of the utilized Machine Learning algorithm [27] and defines the number of neighbors that need to be taken into consideration to detect the outliers. As mentioned in Section 3.4, contamination represents the proportion of outliers in the dataset and its value defines the number of objects to be predicted as anomalies. Contamination can be set as a float number with a value between 0 and 0.5 [27].