Integrating Traffics with Network Device Logs for Anomaly Detection

Figure 4

The F1 value obtained by each method over the phishing email.