An Imbalanced Malicious Domains Detection Method Based on Passive DNS Traffic Analysis

Table 2

The macroaveraged P, R, and F1 score comparison of four schemes.

	HAC_EasyEnsemble									EasyEnsemble
	Complete Link			Group Average			Ward’s Method			non-clustering
	Precision	Recall	F1	Precision	Recall	F1	Precision	Recall	F1	Precision	Recall	F1
Benign	0.9712	0.9500	0.9605	0.9774	0.9591	0.9682	0.9837	0.9622	0.9728	0.9534	0.9375	0.9454
Malicious	0.9552	0.9533	0.9542	0.9491	0.9567	0.9529	0.9651	0.9667	0.9659	0.9181	0.9300	0.9240
Macro-ave	0.9632	0.9517	0.9574	0.9633	0.9579	0.9605	0.9744	0.9645	0.9694	0.9358	0.9338	0.9347