# Big Data-Driven Deep Learning Ensembler for DDoS Attack Detection
## 4 Simulation and Results
### Confusion Matrix and ROC Curve Analysis  
The performance of classifiers on the IoT-23 and APA-DDoS datasets is demonstrated in Figure (a)a,b through confusion matrices. The confusion matrix for the IoT-23 dataset is depicted in Figure 3, which comprises eight classes: \"Attack\", \"Benign\", \"C&C\", \"Okiru\", \"DDoS\", \"C&C HeartBeat\", \"C&C Tori\", and \"HorizontalPort Scan\". The matrix suggests that the classifier performs well, with many true positives for each class and a relatively low number of misclassifications. The APA-DDoS dataset is comprised of three classes: \"DDoS-PSH-ACK\", \"Benign\", and \"DDoS-ACK\". FIGURE 4 illustrates the confusion matrix. This matrix also exhibits robust classifier performance, with minimal misclassifications and high accuracy in predicting each class. Both figures underscore the classifiers' ability to differentiate between various categories of network activities and attacks within their respective datasets.  
Figure 10 displays the ROC curves that compare the effectiveness of the existing and proposed methods in detecting DDoS attacks on two datasets, namely IoT-23 and APA-DDoS. The AUC score measures how well the model detects DDoS attacks without false alarms. A high ROC curve suggests the model regularly balances recognizing genuine positives and avoiding false positives. These curves evaluate the ratio of genuine positives (Sensitivity) to false positives (1--specificity) through threshold settings. According to subfigure (a), which shows the IoT-23 dataset, the suggested strategy outperforms the existing methods in accurately differentiating between positive and negative DDoS attacks. Similarly, the proposed technique shows improved performance in subfigure (b) of the APA-DDoS dataset, indicating that it effectively identifies instances of DDoSA.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Techniques** & **Wilcoxon** & **Spearman’s** & **Chi-Squared** & **Paired Student** & **ANOVA** & **Student** \\ \hline CNN (P-val) & 0.039 & 0.033 & \(-\)0.010 & \(-\)0.010 & 0.000 & 0.026 \\ \hline SVM (F-stat) & 6.375 & 0.602 & 239 & \(-\)4.991 & 58.410 & \(-\)2.099 \\ \hline SVM (P-val) & 0.032 & 0.026 & \(-\)0.010 & 0.000 & 0.001 & 0.039 \\ \hline DBN (F-stat) & 5.310 & 0.448 & 325 & \(-\)6.249 & 68.915 & \(-\)2.997 \\ \hline DBN (P-val) & 0.045 & 0.044 & \(-\)0.010 & \(-\)0.010 & 0.000 & 0.017 \\ \hline \hline \end{tabular}
\end{table}
Table 6: _Cont._  
Figure 9: Confusion matrices of EffiGRU-GhostNet.  
Tables 7 and 8 show the IoT-23 and APA-DDoS datasets' False Positives (FP) and True Negatives (TN) for each class. In all datasets, EffiGRU-GhostNet has low FP counts, such as 4 for \"HorizontalPort Scan\" and 2 for \"Attack\" in IoT-23 and 6 for \"DDoS-PSH-ACK\" and 7 for \"Benign\" in APA-DDoS, suggesting its accuracy recognizing benign traffic. High TN values, such as 90,493 for \"Benign\" and 87,498 for \"DDoS\" in IoT-23 and 23,959 for \"DDoS-ACK\" in APA-DDoS, demonstrate the model's capacity to prevent superfluous warnings. EffiGRU-GhostNet's low FP rates across both tables demonstrate its applicability for real-time DDoS detection in various contexts, where decreasing false positives is crucial for operational stability and efficiency.