1 Introduction
2 Proposed approach
2.1 Notations for Domino drift effect (DDE)
2.2 DDE probability lift curve
2.3 Theoretical design of the DDE model
3 Related works
4 Prediction by the DDE method
4.1 Used datasets in the experiments
4.2 Detecting drift points
4.3 Drift curve fitting and prediction algorithm by DDE
4.4 Further use cases
5 Experimental results
5.1 Lift curve example as a results of the initialization phase
Threshold | No. Feature pairs | No. Double drifting feature pairs | DDE probability | DDE lift |
---|---|---|---|---|
0.0 | 19,900 | 1176 | 0.24 | 1.00 |
0.1 | 13,755 | 1078 | 0.32 | 1.33 |
0.2 | 8401 | 722 | 0.35 | 1.45 |
0.3 | 5532 | 581 | 0.43 | 1.78 |
0.4 | 3332 | 446 | 0.55 | 2.27 |
0.5 | 2158 | 354 | 0.67 | 2.78 |
0.6 | 1501 | 295 | 0.80 | 3.33 |
0.7 | 1105 | 240 | 0.89 | 3.68 |
0.8 | 799 | 184 | 0.94 | 3.90 |
0.9 | 491 | 118 | 0.98 | 4.07 |
5.2 Aggregate results with multiple drift points
5.3 Evaluation of the prediction of new feature drifts
Resources (%) | No. Monitored features | ||||||
---|---|---|---|---|---|---|---|
280 | 140 | 70 | 35 | 17 | 8 | ||
100% | 50% | 25% | 13% | 6% | 3% | ||
DDE-ADWIN | Recall | 1.0000 | 0.9992 | 0.9930 | 0.9672 | 0.9175 | 0.8436 |
Precision | 0.7871 | 0.5297 | 0.3964 | 0.3367 | 0.3079 | 0.2951 | |
F1 | 0.8808 | 0.6924 | 0.5666 | 0.4996 | 0.4610 | 0.4373 | |
DDE-KS | Recall | 0.9878 | 0.8950 | 0.8150 | 0.8004 | 0.7055 | 0.6924 |
Precision | 0.7623 | 0.6000 | 0.5147 | 0.4609 | 0.4170 | 0.3704 | |
F1 | 0.8605 | 0.7184 | 0.6309 | 0.5850 | 0.5242 | 0.4826 | |
DDE-Wass | Recall | 0.9911 | 0.9839 | 0.9759 | 0.9785 | 0.9491 | 0.8907 |
Precision | 0.7787 | 0.6674 | 0.5916 | 0.5614 | 0.5354 | 0.5318 | |
F1 | 0.8721 | 0.7953 | 0.7366 | 0.7134 | 0.6846 | 0.6660 | |
DDE-JS | Recall | 1.0000 | 1.0000 | 1.0000 | 1.0000 | 1.0000 | 0.7000 |
Precision | 0.7845 | 0.8061 | 0.7774 | 0.7975 | 0.7644 | 0.6750 | |
F1 | 0.8792 | 0.8922 | 0.8724 | 0.8760 | 0.8548 | 0.6833 |
Resources (%) | No. Monitored features | ||||||
---|---|---|---|---|---|---|---|
200 | 100 | 50 | 25 | 12 | 6 | ||
100% | 50% | 25% | 13% | 6% | 3% | ||
DDE-ADWIN | Recall | 0.9800 | 0.9963 | 0.9642 | 0.8608 | 0.7254 | 0.5586 |
Precision | 0.8680 | 0.5712 | 0.4261 | 0.3634 | 0.3232 | 0.2952 | |
F1 | 0.9206 | 0.7261 | 0.5910 | 0.5110 | 0.4471 | 0.3863 | |
DDE-KS | Recall | 1.0000 | 1.0000 | 1.0000 | 0.9985 | 0.9455 | 0.7769 |
Precision | 0.7576 | 0.5955 | 0.4645 | 0.4007 | 0.3571 | 0.3429 | |
F1 | 0.8621 | 0.7465 | 0.6343 | 0.5719 | 0.5184 | 0.4758 | |
DDE-Wass | Recall | 1.0000 | 1.0000 | 1.0000 | 0.9984 | 0.8957 | 0.8654 |
Precision | 0.8730 | 0.5945 | 0.4580 | 0.3854 | 0.3348 | 0.3374 | |
F1 | 0.9322 | 0.7457 | 0.6283 | 0.5561 | 0.4874 | 0.4855 | |
DDE-JS | Recall | 0.9091 | 0.9229 | 0.9091 | 0.9213 | 0.8060 | 0.9000 |
Precision | 0.7576 | 0.7634 | 0.7867 | 0.7506 | 0.6615 | 0.5333 | |
F1 | 0.8264 | 0.8346 | 0.8407 | 0.8189 | 0.7013 | 0.5567 |
5.4 Experiments on the effects of performance as a function of the number of monitored features
Dataset | No. Monitored features | Resource (%) | Recall | Precision | F1 |
---|---|---|---|---|---|
CICIDS | 19 | 100.00 | 1.0000 | 0.9000 | 0.9400 |
9 | 47.37 | 0.7758 | 0.7148 | 0.7122 | |
COVERTYPE | 16 | 100.00 | 1.0000 | 1.0000 | 1.0000 |
7 | 43.75 | 0.6177 | 0.5215 | 0.5492 |
Resources (%) | No. Monitored features | ||||||
---|---|---|---|---|---|---|---|
280 | 140 | 70 | 35 | 17 | 8 | ||
100% | 50% | 25% | 13% | 6% | 3% | ||
DDE | Recall | – | 0.9992 | 0.9930 | 0.9672 | 0.9175 | 0.8436 |
Precision | – | 0.5297 | 0.3964 | 0.3367 | 0.3079 | 0.2951 | |
F1 | – | 0.6924 | 0.5666 | 0.4996 | 0.4610 | 0.4373 | |
Reduced monitoring | Recall | – | 0.7000 | 0.3500 | 0.1750 | 0.0850 | 0.0400 |
Precision | – | 0.8000 | 0.7800 | 0.8000 | 0.8100 | 0.7800 | |
F1 | – | 0.7467 | 0.4832 | 0.2872 | 0.1539 | 0.0761 | |
Reduced random | Recall | – | 0.4119 | 0.2594 | 0.2000 | 0.1630 | 0.1393 |
Precision | – | 0.6179 | 0.4548 | 0.3750 | 0.3151 | 0.2747 | |
F1 | – | 0.4943 | 0.3304 | 0.2609 | 0.2148 | 0.1849 | |
Full monitoring | Recall | 1.0000 | – | – | – | – | – |
Precision | 0.7940 | – | – | – | – | – | |
F1 | 0.8852 | – | – | – | – | – |
Resources (%) | No. Monitored features | ||||||
---|---|---|---|---|---|---|---|
200 | 100 | 50 | 25 | 12 | 6 | ||
100% | 50% | 25% | 13% | 6% | 3% | ||
DDE | Recall | – | 0.9963 | 0.9642 | 0.8608 | 0.7254 | 0.5586 |
Precision | – | 0.5712 | 0.4261 | 0.3634 | 0.3232 | 0.2952 | |
F1 | – | 0.7261 | 0.5910 | 0.5110 | 0.4471 | 0.3863 | |
Reduced monitoring | Recall | – | 0.5000 | 0.2500 | 0.1250 | 0.0570 | 0.0285 |
Precision | – | 0.8700 | 0.8700 | 0.9100 | 0.8000 | 0.8900 | |
F1 | – | 0.6350 | 0.3884 | 0.2198 | 0.1064 | 0.0552 | |
Reduced random | Recall | – | 0.4333 | 0.2626 | 0.1928 | 0.1646 | 0.1548 |
Precision | – | 0.6500 | 0.4583 | 0.3602 | 0.3204 | 0.3041 | |
F1 | – | 0.5200 | 0.3339 | 0.2512 | 0.2175 | 0.2052 | |
Full monitoring | Recall | 0.9800 | – | – | – | – | – |
Precision | 0.8680 | – | – | – | – | – | |
F1 | 0.9206 | – | – | – | – | – |
No. Monitored features | |||||||
---|---|---|---|---|---|---|---|
280 | 140 | 70 | 35 | 17 | 8 | ||
ADWIN | Full | 714 | – | – | – | – | – |
DDE | – | 357.3 | 178.9 | 89.7 | 43.8 | 20.9 | |
Reduced monitoring | – | 357.0 | 178.5 | 89.3 | 43.4 | 20.4 | |
Reduced random | – | 357.1 | 178.7 | 89.5 | 43.6 | 20.7 | |
KS | Full | 238 | – | – | – | – | – |
DDE | – | 119.3 | 59.9 | 30.2 | 14.9 | 7.3 | |
Reduced monitoring | – | 119.0 | 59.5 | 29.8 | 14.5 | 6.8 | |
Reduced random | – | 119.1 | 59.7 | 30.0 | 14.7 | 7.1 | |
Wass | Full | 166.6 | – | – | – | – | – |
DDE | – | 83.6 | 42.1 | 21.3 | 10.6 | 5.2 | |
Reduced monitoring | – | 83.3 | 41.7 | 20.8 | 10.1 | 4.8 | |
Reduced random | – | 83.4 | 41.9 | 21.1 | 10.4 | 5.0 | |
JS | Full | 126.14 | – | – | – | – | – |
DDE | – | 63.4 | 31.9 | 16.2 | 8.1 | 4.1 | |
Reduced monitoring | – | 63.1 | 31.5 | 15.8 | 7.7 | 3.6 | |
Reduced random | – | 63.2 | 31.7 | 16.0 | 7.9 | 3.9 |
No. Monitored features | |||||||
---|---|---|---|---|---|---|---|
200 | 100 | 50 | 25 | 12 | 6 | ||
ADWIN | Full | 510 | – | – | – | – | – |
DDE | – | 255.3 | 127.9 | 64.1 | 31.0 | 15.7 | |
Reduced monitoring | – | 255.0 | 127.5 | 63.8 | 30.6 | 15.3 | |
Reduced random | – | 255.1 | 127.7 | 63.9 | 30.8 | 15.5 | |
KS | Full | 170 | – | – | – | – | – |
DDE | – | 85.3 | 42.9 | 21.6 | 10.6 | 5.5 | |
Reduced monitoring | – | 85.0 | 42.5 | 21.3 | 10.2 | 5.1 | |
Reduced random | – | 85.1 | 127.7 | 63.9 | 30.8 | 15.5 | |
Wass | Full | 119 | – | – | – | – | – |
DDE | – | 59.8 | 30.1 | 15.3 | 7.5 | 4.0 | |
Reduced monitoring | – | 59.5 | 29.8 | 14.9 | 7.1 | 3.6 | |
Reduced random | – | 59.6 | 29.9 | 15.1 | 7.3 | 3.8 | |
JS | Full | 90.1 | – | – | – | – | – |
DDE | – | 45.4 | 22.9 | 11.6 | 5.8 | 3.1 | |
Reduced monitoring | – | 45.1 | 22.5 | 11.3 | 5.4 | 2.7 | |
Reduced random | – | 45.2 | 22.7 | 11.4 | 5.6 | 2.9 |