Hi. In this video we will learn how to do B variate analysis,
which is the analysis of a relationship between two variables.
We have basically three options.
Analyze relationship of two categorical variables,
two numeric variables or relationship between one categorical and one numeric
variable. For all of these options, there are multiple methods.
First, let's analyze a relationship between two categorical variables.
We can make a group bar chart for this, uh,
where we first calculate the counts for each category combination with the PO
table like here, uh,
where I analyzed the relationship between attack variable and protocol type.
Uh, do not be confused here that I use the duration variable as values.
It basically doesn't matter which variable you use here because we are
calculating only counts.
We see here that the Smurf attack dominates, of course,
because it has the highest number of observations,
but they are only via I C M P protocol.
We see that the Neptune attack uses only T C P protocol and normal connection
use sees, uh, mostly T C P protocol, the u d DP and I C M P,
uh, to have a better view of other attacks. Uh,
we could filter out these three attack categories,
or we can do stacked relative bar chart where each bar sums to one,
uh, same as we did before. This is the calculation,
and here is the bar chart.
Here.
In this chart is an example of a normal tuck bar chart where we can see a
relationship between flag and, uh, protocol variable
Here.
In the next example is a chart describing relationship of categorical variable
attack with numeric variable count. Uh,
but we bend the numeric variable to beans.
Now we have basically a categorical variable, uh, to be more precise. Uh,
we have an ordinal variable because there is an order in this beans
here. We basically plotted the distribution of count variable per attack. Now,
we are able to see very interesting patterns here, uh,
that for example, the normal connections, uh, they dominate in the lower values,
uh, and with higher values, uh, of the count variable,
we see higher proportions of the teardrop attack. Here's this one
also here. The Neptune attack, uh,
starts to dominate until almost 290
value of the count variable
values of count variable about, uh,
420, uh, is completely covered by the smurf attack,
which has also very high proportions of count values between uh,
300 and 400.
Another way how to interpret this chart is that, uh,
when you randomly sample or when you have data about new unseen
connection and it has value of count variable bigger than 430,
you can be a hundred percent sure it is a smurf attack.
Another interpretation example might be that if you see a new connection
with value of count variable of, uh, 80, for example, here,
there is about a 70% chance it is a Neptune attack,
maybe around 10%. Ss shes,
it is a normal connection and around 15% s shes,
it is a teardrop attack.
Here is another example of plotting the distribution of numeric variable, uh,
per categorical variable. We can use the box plot for this.
We see here that most of the distribution, uh, of count variable in uh,
I C M P protocol is squeezed around the value of 500.
We have learned already that it is basically the smurf attack.
Do not be confused with this, uh, think blank line. Uh,
these are basically the outliers plotted or on top of each other.
Another example of group to box plot is here where we see the
relationship between attack and count variable from another perspective,
although we cannot conclude from this, the probabilities, uh,
we can see interesting patterns as well. Uh, for example
here the Saturn attack has distribution of count variable squeeze around, uh,
500, uh, same as the smurf attack.
We can check the relationship between attack and service count variable. Uh,
we see that the Smurf attack has also the distribution squeeze around
500, but not the, uh, Satan attack.
Another very useful way to plot categorical variable versus numeric is, uh,
faceted the histogram where the x axis,
y axis or both are shared. Uh, here,
the service count variable on the axis is shared. Uh,
that means all charts have, uh, x axis on the same scale,
and we can compare the distribution in form of a histogram.
Here I wanted to see the distribution of, uh,
duration variable per attack to see if there are any interesting patterns.
It is better that we zoom in. Uh, we can use the island parameter for this.
We see that the pore sweep attack has, uh, very interesting patterns. Uh,
you see that, uh, the attacks, uh, are equally spaced.
Now let's check how to analyze, uh, relationship between two numeric variables.
The most common chart to do this is the scatter plot,
but when you have many points, uh, there is a problem that they are overlapping,
we can solve it partially with the alpha parameter. Uh, but anyway, in our case,
there are half a million points plotted on this chart,
and it is very hard to identify the dense areas.
We do not know if this is the most dense area or this one,
or this one or this one. For example,
we have seen that, uh, we can bin numeric variable into bins. Uh, so now, uh,
we see more information. What is their relationship? We can
plot also a line chart with the median and the mean, uh,
to better see some patterns. Uh, we see here a big jump in around,
uh, value of 300 of the count variable, but as we already know,
there are multiple populations depending on the attack. Uh,
so discharge provides you some information, but not all of it.
In our next video, we will learn how to do multivariate analysis, uh,
which is the analysis of relationship between more than two variables.