# A Lightweight Model for DDoS Attack Detection Using Machine Learning Techniques
## 4 Results and Discussion
### Naive Bayes  
A supervised machine learning method called naive bayes is utilized for categorization problems. It is founded on the Bayes theorem, according to which the likelihood of a hypothesis--in this case, a class label--given the evidence (the input features) is inversely proportional to the likelihood of the evidence given the hypothesis, multiplied by the prior probability of the hypothesis. Given the class label, naive bayes assumes that the input features are independent of one another. The approach learns the prior probability of each class label as well as the conditional probability of each input feature given each class label. A method known as maximum likelihood estimate is used for this. \[P(A|B)=\frac{P(B|A)*P(A)}{P(B)} \tag{2}\]  
The confusion matrix is given for TONIOT and BOTIOT, representing binary and multiple-class classification for each (Case 1 to Case 4) for 15 features (Table 6). In Case 1, which corresponds to multiple-class classification for the TON-IOT dataset, it is observed that the FP value is higher than the FN value, and hence there are chances that normal traffic can be detected as an attack. However, the TP and TN values do not really compensate for the FP and FN values as the margin between them is fairly small, so the accuracy would result in being minimal compared to other models and does prove to be not effective. Similarly, in Case 3 with the BOT-IOT dataset for multi-class classification with a higher number of records than TON-IOT, there is a fairly high margin for TP and TN values compared to FP and FN values and hence it gives much higher accuracy. In cases 1 and 4,  
Figure 6: (**a**) ROC curve for TON-IOT all attacks (15 features), RF; (**b**) ROC curve for TON-IOT DDoS attacks (15 features), RF; (**c**) ROC curve for BOT-IOT all attacks (15 features), RF; (**d**) ROC curve for BOT-IOT DDoS attacks (15 features), RF. with TON-IOT and BOT-IOT datasets for binary classification, both FP and FN values are zero, and therefore tend to obtain the maximum accuracy. It is observed that Figure 7b,d correspond to the binary classification for TON-IOT and BOT-IOT, respectively, and the steep ROC curve touches the top left corner, which makes these two cases very good models. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **Case 1 (All Attacks)** & & & **Case 2 (DDoS Attacks)** \\ \hline True/Predict & Class 0 (Normal) & Class 1 (Attack) & True/Predict & Class 0 (Normal) & Class 1 (Attack) \\ \hline Class 0 (Normal) & 34,056 & 25,997 & Class 0 (Normal) & 60,059 & 0 \\ Class 1 (Attack) & 96 & 32,060 & Class 1 (Attack) & 0 & 3941 \\  & **Case 3 (All Attacks)** & & & **Case 4 (DDoS Attacks)** & \\ True/Predict & Class 0 (Normal) & Class 1 (Attack) & True/Predict & Class 0 (Normal) & Class 1 (Attack) \\ Class 0 (Normal) & 733,624 & 0 & Class 0 (Normal) & 385,300 & 0 \\ Class 1 (Attack) & 0 & 81 & Class 1 (Attack) & 0 & 121 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Confusion matrix for TON-IOT (Case 1 and Case 2), BOTOT (Case 3 and Case 4), and NB (15 features). Figure 7: (**a**) ROC curve for TON-IOT all attacks (15 features), NB; (**b**) ROC curve for TON-IOT DDoS attacks (15 features), NB; (**c**) ROC curve for BOT-IOT all attacks (15 features), NB; (**d**) ROC curve for BOT-IOT DDoS attacks (15 features), NB. In Figure 7a with the TON-IOT dataset for multiple-class classification, it is observed that the curve is closer to the diagonal, hence making it a very poor model compared to Figure 7c with BOT-IOT dataset for multiple-class classification. For Figure 7c, it is observed that the curve is almost touching the top left corner, and hence it is very much a better model with greater accuracy. Similarly, the AUC scores are variable with respect to their ROC curves as observed below. By computing the posterior probabilities of each class label given the input features and selecting the class label with the highest probability as the prediction, the model may be used to make predictions on new data after it has been trained.