## 7 Results and Discussion  
### Evaluation Metrics  
The metrics used for evaluating the machine learning models were derived from the _confusion matrix_[30]. As shown in Table 3, the confusion matrix contains the four categories of outputs from a binary classifier. For our case here, the categories were (1) true positive (TP), when the model correctly identifies a DDoS attack; (2) true negative (TN), when it correctly identifies benign data; (3) false positive (FP), when it incorrectly identifies benign data as a DDoS attack; and (4) false negative (FN), when the model incorrectly identifies a DDoS attack as benign.  
This study used the following standard evaluation metrics to measure the performance of the models [36]:  
1. Accuracy [\((TP+TN)/Total\)]: the percentage of true DDoS attack data detection over total data instances.
2. Precision [\(TP/(FP+TP)\)]: the measurement of how often the model correctly identifies a DDoS attack.
3. False-positive rate (FPR) [\(FP/(FP+TN)\)]: how often the model raises a false alarm by identifying a normal data instance as a DDoS attack.
4. Recall [\(TP/(FN+TP)\)]: the measurement of how many of the DDoS attacks the model does identify correctly. Recall is also known as the true-positive rate, sensitivity, or DDoS detection rate.
5. F1 score [\(2 Precision*Recall/(Precision+Recall)\)]: the harmonic average of precision and recall.  
We also used the ROC AUC score, which provides the diagnostic ability of binary classifiers. The ROC curve is a plot of the true-positive rate (TPR) against the false-positive rate (FPR). In DDoS detection, the higher the ROC, the better the model at discriminating DDoS from benign traffic. We also measured the elapsed times for training and testing for each model.  
\begin{table}
\begin{tabular}{l c c c} \hline \hline
**Feature** & **Algorithm** & **Feature** & \\
**Set** & **Used** & **Count** & **Features** \\ \hline PS-1 & Degree of dependency & 24 & 2, 3, 4, 5, 7, 8, 10, 13, 23, 24, 25, 26, 27, 28, 29, 30, \\  & and dependency ratio & & 33, 34, 35, 36, 38, 39, 40, 41 \\ FS-2 & FS-3 \(\cap\) FS-4 \(\cap\) FS-5 \(\cap\) FS-6 & 13 & 3, 4, 29, 33, 34, 12, 39, 5, 30, 38, 25, 23, 6 \\ FS-3 & Information gain & 14 & 5, 3, 6, 4, 30, 29, 33, 34, 35, 38, 12, 39, 25, 23 \\ FS-4 & Gain ratio & 14 & 12, 26, 4, 25, 39, 6, 30, 38, 5, 29, 3, 37, 34, 33 \\ FS-5 & Chi-squared & 14 & 5, 3, 6, 4, 29, 30, 33, 34, 35, 12, 23, 38, 25, 39 \\ FS-6 & ReliefF & 14 & 3, 29, 4, 32, 38, 33, 39, 12, 36, 23, 26, 34, 40, 31 \\ FS-7 & Mutual information gain & 12 & 23, 5, 3, 6, 32, 24, 12, 2, 37, 36, 31 \\ FS-8 & Domain knowledge & 16 & 2, 4, 10, 14, 17, 19, 21, 24, 25, 26, 27, 30, 31, 34, 35, 39 \\ FS-9 & Gain ratio & 35 & 9, 26, 25, 4, 12, 39, 30, 38, 6, 29, 5, 37, 11, 3, 22, 35, 34, 14, 33, \\  & & 23, 8, 10, 31, 27, 28, 32, 1, 36, 2, 41, 40, 17, 13, 16, 19 \\ FS-10 & Information gain & 19 & 3, 4, 5, 6, 12, 23, 24, 25, 26, 29, 30, 32, 33, 34, 35, 36, 37, 38, 39 \\ FS-11 & Genetic algorithm & 15 & 4, 5, 6, 8, 10, 12, 17, 23, 26, 29, 30, 32, 37, 38, 39 \\ FS-12 & Full set & 41 & All features \\ \hline \hline \end{tabular}
\end{table}
Table 2: Reduced feature sets for NSL-KDD dataset that were used in experiments (adopted from [6]).  
\begin{table}
\begin{tabular}{l c c} \hline \hline  & **Predicted** & **Predicted** \\  & **Normal** & **Attack** \\ \hline Actual Normal & TN & FP \\ Actual Attack & FN & TP \\ \hline \hline \end{tabular}
\end{table}
Table 3: The confusion matrix.