Table 21 Comparison between FE and FS in various scenarios
No. | Content | FS | FE |
|---|---|---|---|
1 | Higher accuracy when no. of features is small, such as 9 and 22 | ✓ | |
2 | Higher accuracy when no. of features gets large, such as 33 and 47 | ✓ | |
3 | Lower feature reduction time | ✓ | |
4 | Lower model training time | ✓ | |
5 | Lower inference time | ✓ | |
6 | DT is the most favorite classifier considering runtime | ✓ | ✓ |
7 | DT is the most favorite classifier considering performance for multi-classification with small and moderate number of features, such as 9, 22, and 33 | ✓ | ✓ |
8 | MLP is the most favorite classifier considering performance for multi-classification with more features, such as 47 and 77 | ✓ | ✓ |
9 | Less sensitive to the number of selected/extracted features | ✓ | |
10 | Less sensitive to various machine learning models | ✓ | |
11 | Detection performance degrades when number of features is too large | ✓ | |
12 | Detection performance increase when more informative features added | ✓ | |
13 | Detect more diverse attack types when using the same classifier | ✓ | |
14 | F1-score of attack class is much lower than that of normal class (binary) | ✓ | ✓ |
15 | F1-score of attack class degrades when number of features increases (binary) | ✓ | |
16 | Higher F1-score in detecting DDoS, normal, scanning and XSS classes | ✓ | |
17 | Higher F1-score in detecting injection classes | ✓ | |
18 | More potential to improve performance when the number of features is small | ✓ | |
19 | More potential to improve performance when the number of features is large | ✓ |