# A Multi-Model Proposal for Classification and Detection of DDoS Attacks on SCADA Systems
## 5 Experimental Results
### Discussion
As can be seen in Table 7, different algorithms were used for various datasets in the detection of attacks on SCADA systems. Each dataset had different characteristics and should be evaluated on its own. In the studies examined in the literature, machine learning and deep learning approaches had achieved an average of over 90% success in attack detection on SCADA systems. As a result of the analyses performed in this study, two models based on deep learning and machine learning were proposed. With the hybrid model using LSTM and \begin{table}
\begin{tabular}{c c c} \hline \hline
**References** & **Datasets** & **Algorithms** & **Detection Rate (\%)** \\ \hline \multirow{6}{*}{[17]} & Random Forest & 99.89 \\ \cline{2-3}  & Decision Tree & 99.89 \\ \cline{2-3}  & Their own dataset & Logistic Regression & 99.59 \\ \cline{2-3}  & Naive Bayes & 99.60 \\ \cline{2-3}  & KNN & 72.29 \\ \hline
[18] & Mississippi State University SCADA Laboratory & Neural Network & Average 83.00 \\ \hline \multirow{6}{*}{[19]} & SVDD & Average 84.00 \\ \cline{2-3}  & \multirow{2}{*}{Water distribution system real dataset} & Robust SVM & Average 76.00 \\ \cline{2-3}  & & Slab SVM & Average 82.00 \\ \cline{2-3}  & Proposed Method & Average 91.00 \\ \hline
[20] & Their own dataset & Hybrid SCADA-IDS & 100 \\ \hline
[21] & DUWWTP Dataset & KNN & 92.86 \\ \hline
[22] & CyberGym SCADA Lab dataset & ANN-based SOM & Average 85.00 \\ \cline{2-3}  & Ben-Gurion University of the Negev SCADA Lab Dataset & HMM & Average 88 \\ \hline \multirow{6}{*}{[23]} & \multirow{2}{*}{Their own dataset} & FNN & Average 99.00 \\ \cline{2-3}  & & LSTM & Average 99.00 \\ \cline{2-3}  & & FNN-LSTM & Average 99.00 \\ \hline
[24] & Their own dataset & OCSVM & 96.30 \\ \hline
[25] & Their own dataset & MTO-based LSTM & Average 99.00 \\ \cline{2-3}  & & MTM-based LSTM & Average 98.00 \\ \hline \multirow{6}{*}{[26]} & \multirow{6}{*}{ADFA-LD Dataset} & IWP-CSO + SVM & 91.50 \\ \cline{2-3}  & & HNA-NN & 83.20 \\ \cline{2-3}  & & IWP-CSO + HNA-NN & 93.10 \\ \cline{2-3}  & SVM & 74.90 \\ \hline \multirow{3}{*}{Our Study} & \multirow{2}{*}{Our Dataset} & HYBRID3b Model & 94.73 \\ \cline{2-3}  & & Decision Tree Model & 98.77 \\ \cline{1-1} \cline{2-3}  & Mississippi State University SCADA Laboratory & HYBRID3b Model & 98.09 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Comparison of studies in the literature. CNN algorithms together, 95% success was achieved. A higher success rate of 99% was achieved with the decision tree-based model. When we consider the existing research on the subject, we obtained promising models by creating an appropriate testbed, utilizing relevant technologies, and preparing dataset features. It is difficult to directly compare the performances of different models with the results obtained from studies using different datasets. Therefore, a different technique was used to demonstrate the performance of our proposed deep learning-based hybrid model. A dataset [5], which is frequently used in the literature and included in the benchmark table, was selected and evaluated for analysis. This dataset prepared by [PERSON] et al. was analyzed with our proposed HYBRID3b model and a high success rate was obtained for attack detection. This result was shown in the last row of Table 7.  
It has been observed that our proposed models have higher or very close performances compared to other models in the literature. Due to the diversification and development of attacks, it is important to carry out new analyses on different environments, and this has been achieved in this study. As a result, it is important that attack detection studies for SCADA systems are frequently updated and diversified.