## 3 Analysis and Comparison of Machine Learning-Based Anomaly Detection
### Evaluation  
The performance of the applied classifiers over the ARAS dataset was measured by utilizing several metrics including the accuracy, precision, recall, F-1 score, macro average F-1, and weighted average F-1, presented in Equations (8)-(13). The value ranges of these metrics are between between 0 and 1, with 1 indicating the best performance. As the dataset is slightly imbalanced, we used the macro average F-1 and weighted average F-1 to ensure reliable performance comparison. The description of each metric and its formula is as follows: _Accuracy_: For the accuracy, we measured the proportion of correctly classified predictions among the total number of predictions.  
\[Accuracy=\frac{TP+TN}{TP+FN+TN+FP} \tag{8}\]  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Models** & **Hyper-Parameters** \\ \hline Decision Tree & Criterion: Gini \\ Random Forest & Default Parameters \\ Gaussian Naive Bayes & No Hyper-parameters \\ LGBM Classifier & Default Parameters \\ Support Vector Machine & Kernel: RBF, \(\gamma=0.001\), \(C=100\) \\ Logistic Regression & Default Parameters \\ k-Nearest Neighbors & Number of Neighbors: 5 \\ Gradient Boosting Classifier & Default Parameters \\ LSTM & Sequence Length: 1, \\ Hidden Dimension: 64, & Number of Layers: 2, \\ Optimizer: Adam, & Loss Function: Cross-Entropy Loss, \\ Batch Size: 32, & Batch Size: 32, \\ Epoch: 100 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Model hyper-parameters.  
where TP refers to the number of true positives, TN refers to the number of true negatives, FP represents the number of false positives, and FN denotes the number of false negatives. These measures refer to the actual number of instances a classifier model has correctly (referring to true) or incorrectly (falsely) predicted in the positive or negative class (where positive and negative in this context refer to being or not being in a defined class, respectively).  
_Precision:_ Precision measures the proportion of instances that are correctly classified as positive (TP) among all positive predictions made.  
\[Precision=\frac{TP}{TP+FP} \tag{9}\]  
_Recall:_ This score measures the proportion of true positive predictions among all actual positive instances, whether they are correctly classified as positive or incorrectly classified as negative (FN). Recall is, thus, calculated as the number of true positive predictions divided by the sum of true positive and false negative predictions.  
\[Recall=\frac{TP}{TP+FN} \tag{10}\]  
_F-1 score:_ The F-1 score is the harmonic mean of the precision and recall.  
\[F\text{-1}=\frac{2\times Precision\times Recall}{Precision+Recall} \tag{11}\]  
_Macro average F-1:_ This score calculates the F-1 score for each class independently and then takes the unweighted average of these scores. Unweighted average means that this score will treat all the classes equally regardless of the number of instances they have.  
\[Macro\ Average\ F\text{-1}=\frac{\sum_{i=1}^{N}F\text{-1}\ Score_{i}}{N} \tag{12}\]  
_Weighted average F-1_: This score calculates the F-1 score for each class independently and then takes the weighted average of these scores, weighted by the number of true instances for each class. In this score, the classes with more instances will receive a higher weight in the calculation.  
\[Weighted\ Average\ F\text{-1}=\sum_{i=1}^{N}w_{i}\times F\text{-1}\ Score_{i} \tag{13}\]  
In the above measures, TP, TN, FN, FP, \(N\), and \(w\) denote the number of true positives, the number of true negatives, the number of false negatives, the number of classes, and the weight assigned to each class, respectively.