# Multi-Resolution Analysis with Visualization to Determine Network Attack Patterns
## 7 Conclusions and Future Works  
This paper introduces a new way of analyzing intrusion detection datasets. Although various approaches have been proposed by incorporating machine learning algorithms, most techniques still suffer from detecting unknown attacks. To address the limitation, our study focuses on integrating MRA with visualization. Specifically, the DWT is used to determine significant wavelet features from the data. Then, the utilization of interactive visualization is considered to represent the network traffic features to support interactive visual analysis. Because of the complexity of network traffic data, we performed extensive evaluation studies to determine optimal parameter values for applying the DWT to different network traffic datasets. Classification analysis with SVM, NB, and KNN was performed to determine the effectiveness of using MRA with visualization. A hierarchical clustering method was also applied to identify clusters for normal and attack events by measuring the Davies-Bouldin Index scores. From the study, we found that a small step size (\(\beta<=20\)) with a relatively large sliding window size (\(\alpha>=150\)) formed distinctive clusters in differentiating normal and attack events. We also conclude that our approach of utilizing MRA with visualization advances network intrusion detection by generating well-separated visual clusters.  
For future works, we plan to extend our study to test all possible input parameters and measure sensitivity and specificity in detecting network intrusions with various imbalanced data analysis techniques. Furthermore, a comparative study with known intrusion detection models will be conducted to determine the benefits and limitations of our approach. Since analyzing network traffic data to find optimal parameters requires tremendous computational time and costs, finding a solution that automatically determines the parameters is essential. Specifically, we plan to design an approach that determines the parameters automatically by evaluating the unique characteristics of network traffic data. With the proposed approach, a real-time intrusion detection system can be designed and tested to detect intrusions in a real network environment.  
Conceptualization, [PERSON] and [PERSON]; methodology, [PERSON] and [PERSON]; software, [PERSON]; validation, [PERSON] and [PERSON]; formal analysis, [PERSON] and [PERSON]; investigation, [PERSON] and [PERSON]; resources, [PERSON] and [PERSON]; data curation, [PERSON] and [PERSON]-[PERSON]; writing--original draft preparation, [PERSON], [PERSON] and [PERSON]; writing--review and editing, [PERSON], [PERSON] and [PERSON]; visualization, [PERSON] and [PERSON]; supervision, [PERSON], [PERSON] and S.-Y.J.; project administration, D.H.J. and S.-Y.J.; funding acquisition, D.H.J. and S.-Y.J. All authors have read and agreed to the published version of the manuscript.  
This material is based upon work supported by the National Science Foundation (Grant No. 2107451 and 2219634).  
Not applicable.  
The Kyoto2016+ dataset is available at the website at [[https://www.takakura.com/Kyoto_data/](https://www.takakura.com/Kyoto_data/)]([https://www.takakura.com/Kyoto_data/](https://www.takakura.com/Kyoto_data/)) (accessed on 10 January 2022). Both the NSLKDD dataset and the CICIDS2017 dataset were obtained at [[https://www.umb.ca/cic/datasets/nsl.html](https://www.umb.ca/cic/datasets/nsl.html)]([https://www.umb.ca/cic/datasets/nsl.html](https://www.umb.ca/cic/datasets/nsl.html)) and [[https://www.umb.ca/cic/datasets/ids-2017.html](https://www.umb.ca/cic/datasets/ids-2017.html)]([https://www.umb.ca/cic/datasets/ids-2017.html](https://www.umb.ca/cic/datasets/ids-2017.html)), respectively (accessed on 10 January 2022). The complete analysis data and source codes will become available upon request by email.  
The authors declare no conflict of interest. The funder had no role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript; or in the decision to publish the results.