# A Novel Hybrid Unsupervised Learning Approach for Enhanced Cybersecurity in the IoT
## 5 Results
### Performance Analysis of Proposed Method
#### 5.6.3 Stage 2 Combined Methods  
The rationale for implementing a two-stage anomaly detection approach with OCSVM and dAE is to leverage the respective strengths of each technique, aiming for improved detection performance. OCSVM and dAE exhibit complementary performance both individually and together.  
\begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**Methods** & **Precision** & **Recall** & **Specificity** & **F-Measure** & **Accuracy** & **FNR** \\ \hline  & & & & & **Detection Stage 1:** \\ OCSVM & 0.7956 & 0.9474 & 0.9754 & 0.8649 & _0.9728_ & _0.0526_ \\ dAE & 0.8008 & 0.9453 & 0.9763 & 0.8671 & 0.9734 & 0.0547 \\ DBSCAN & 0.7916 & 0.9328 & 0.9752 & 0.8564 & 0.9713 & 0.0672 \\  & & & & **Detection Stage 2:** \\ OCSVM + DBSCAN & 0.9561 & 0.9526 & 0.8298 & 0.9544 & 0.9275 & 0.0474 \\ dAE + DBSCAN & 0.9556 & 0.9525 & 0.8222 & 0.9541 & 0.9266 & 0.0475 \\ dAE + OCSVM & 0.7772 & 0.9536 & 0.9985 & 0.8564 & 0.9982 & 0.0464 \\ OCSVM + dAE & 0.9543 & _0.9731_ & 0.9987 & 0.9636 & 0.9966 & 0.0269 \\  & & & & **Detection Stage 3:** \\  & & & & & **Detection Stage 4:** \\  & & & & & \\ \hline \hline \end{tabular}
\end{table}
Table 6: Performance analysis of proposed IDS on CSECIC-IDS2018 dataset.  
Figure 17: Performance comparison of stage 3 clustering OCSVM + dAE + DBSCAN on CSECIC-IDS2018.  
OCSVM correctly identified 227,218 as true positive samples, while dAE detected 226,719, indicating that OCSVM found an additional 499 samples missed by dAE. On the other hand, dAE identified 226,719 samples correctly, while OCSVM detected 227,218, showing that dAE missed 499 samples that OCSVM detected. The combined use of OCSVM and dAE effectively reduces false negatives and false positives to just 340 and 588, respectively. This underscores the method's effectiveness in minimizing detection errors.  
The pairing of OCSVM and DBSCAN achieves high precision and recall but shows decreased specificity, characterized by a lower false negative rate (FNR). The combination of dAE and DBSCAN shows comparable performance, marked by notable enhancements in precision and recall. The combination of dAE and OCSVM achieves high recall but at the cost of relatively lower precision. The combined method of OCSVM and dAE shows substantial improvements in precision, recall, and exceptional specificity, resulting in a notably low false negative rate (FNR). This OCSVM + dAE approach is proposed for stage 2 consideration.  
The two-stage approach improves anomaly detection by leveraging the strengths of both OCSVM and dAE, resulting in a more robust and accurate detection mechanism. The combined method significantly decreases false negatives and false positives compared to using each method individually, providing a strong rationale for adopting a two-stage anomaly detection strategy.  
Stage 3 Proposed Method  
The combination of dAE, OCSVM, and DBSCAN demonstrates strong overall performance with high precision and recall, albeit with reduced specificity. The proposed method, integrating OCSVM, dAE, and DBSCAN, shows superior performance across all metrics--precision, recall, specificity, accuracy, and notably low false negative rate (FNR), as shown in Table 6.