# Model Retraining upon Concept Drift Detection in Network Traffic Big Data
## 4 Algorithms and Evaluation Metrics Used  
### Random Forest  
Random Forest is an ensemble machine learning algorithm that combines multiple decision trees for improved prediction accuracy. Each tree in the forest is built using a random subset of both the training data and features. During prediction, each tree independently evaluates the input and produces its own result. For classification problems, the final output is determined by majority voting across all trees, while for regression problems, it averages all tree predictions. This approach of combining randomized trees helps reduce overfitting and handles both numerical and categorical data effectively, making Random Forest a versatile and robust algorithm for various machine learning classification [31; 32].  
Evaluating Random Forest  
Accuracy measures the overall true correct predictions out of the total predictions in the model. It gives a quick overall sense of how well the model performs. A high accuracy means the model is functioning well while a low accuracy indicates that the data may need to be updated [33].  
\[Accuracy=\frac{(True\;Positives+True\;Negatives)}{(True\;Positives+True\; Negatives+False\;Positives+False\;Negatives)} \tag{1}\]  
Precision reflects the amount of data that was predicted to be an anomaly that were actually anomalies. Calculating precision allows us to avoid false alarms and build trust in the model [34].  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Conn\_State** & **Binned Value** & **Count** \\ \hline OTH & 3 & 9897 \\ \hline SH & 4 & 20,682 \\ \hline RSTRH & 5 & 338 \\ \hline REJ & 6 & 306 \\ \hline RSTR & 7 & 300 \\ \hline RSTO & 8 & 158 \\ \hline S1 & 9 & 39 \\ \hline S2 & 10 & 7 \\ \hline \hline \end{tabular}
\end{table}
Table 8: _Cont._  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**No Data** & **0 Bytes** & **Explanation** \\ \hline Tiny & 1–50 bytes & Typically control packets \\ \hline Small & 51–100 bytes & Small requests/responses \\ \hline Medium & 101–500 bytes & Typical web requests \\ \hline Large & 501–1000 bytes & Larger requests/responses \\ \hline Very Large & 1001–10,000 bytes & File transfers \\ \hline Huge & \textgreater{}10,000 bytes & Large file transfers \\ \hline \hline \end{tabular}
\end{table}
Table 9: Distribution and binning of bytes.  
\[Precision=\frac{(True\:Positives)}{(True\:Positives+False\:Positives)} \tag{2}\]  
Recall identifies how many actual anomalies were correctly identified. Recall (also known as Sensitivity or True Positive Rate) measures how well the model identifies all actual positive cases [34]. Precision focuses on the quality of the positive predictions while recall focuses on the completeness.  
\[Recall=\frac{(True\:Positives)}{(True\:Positives+False\:Negative)} \tag{3}\]  
The F1 score is a balanced measure that combines precision and recall. It provides a single score that balances both the precision and the recall of a model [34].  
\[F1\:Score=\frac{(Precision\times Recall)}{(Precision+Recall)} \tag{4}\]  
The Confusion Matrix summarizes the performance of a classification model. It shows the counts of correct and incorrect predictions made by the model, broken down by each class. The matrix typically consists of four key components:  
1. True Positive (TP): The number of cases where the model correctly predicted the positive class.
2. True Negative (TN): The number of cases where the model correctly predicted the negative class.
3. False Positive (FP): The number of cases where the model incorrectly predicted the positive class when it was actually negative. This is also known as a Type I error.
4. False Negative (FN): The number of cases where the model incorrectly predicted the negative class when it was actually positive. This is also known as a Type II error.