Network Intrusion Anomaly Detection Model Based on Multiclassifier Fusion Technology

Table 3

Anomaly detection algorithm performance comparison (anomaly ratio of 0.05).

Dataset	Performance metrics	LODA	AE	PCA	HBOS	iForest	MV	WMV	NB
CICIDS2017	AUC	0.635	0.576	0.538	0.632	0.657	0.763	0.749	0.852
	RECALL	0.497	0.438	0.401	0.531	0.492	0.794	0.821	0.886
	Time (seconds)	0.511	8.369	0.732	0.902	7.436	7.082	8.198	8.073
UNSW-NB 15	AUC	0.675	0.739	0.852	0.724	0.913	0.871	0.912	0.925
	RECALL	0.724	0.791	0.893	0.852	0.937	0.897	0.943	0.961
	Time (seconds)	0.867	10.023	0.992	1.942	8.241	6.924	8.245	8.128
KDDCUP 99	AUC	0.942	0.923	0.924	0.938	0.953	0.910	0.928	0.956
	RECALL	0.964	0.957	0.940	0.964	0.983	0.924	0.965	0.995
	Time (seconds)	0.735	9.710	1.324	1.672	8.092	7.942	8.124	8.206