# A Multi-Model Proposal for Classification and Detection of DDoS Attacks on SCADA Systems
## 5 Experimental Results
### Results  
In the study, the steps mentioned in Title 4 were carried out on the dataset. Table 4 shows statistical information about network traffic captured while applying attack scenarios and the baseline situation. Captured packets in network traffic represent samples in datasets.  
As shown in Table 4, while there were 3391 packages in the normal situation scenario, there were 19,377 packages in the attack scenarios. The distribution of the number of packages was in a balanced state in all scenarios. The average sizes of packets (in bytes) were the same for TCP, SYN, and ICMP flooding attack scenarios. The spoofing IP flooding attack scenario had the maximum value. When the attack scenarios were analyzed separately, the total packet sizes (in bytes) took different values. In attack scenarios, when the packet capture times were examined, the most listening was done for the baseline situation. The least time was spent on the SYN Flooding attack scenario.  
Analyses were made to reveal the attacks and DDoS attack types on the system. Suggestions were made for the attack detection system. Table 3 presents the analysis of the proposed models results.  
When the performance results were examined, it was seen that the HYBRID3b model was more successful in analyzing and classifying DDoS attack data among deep learning algorithms. Among the machine learning algorithms, the highest success rate was obtained with the decision tree model. Considering the accuracy, precision, recall, and f1-score success metrics, these two models were found to be the most suitable models for attack detection. LSTM models from deep learning algorithms and the ZeroR model from machine learning algorithms performed the attack detection with the lowest success rate. The confusion matrix values obtained with the HYBRID3b model were placed in Table 5 and are shown below.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & & & \multicolumn{5}{c}{**Attack Scenarios Values**} \\ \hline
**Measurement** & **Normal** & **TCP** & **UDP** & **SYN** & **Spoofing IP** & **ICMP** \\
**Flooding** & **Flooding** & **Flooding** & **Flooding** & **Flooding** & **Flooding** \\ \hline
**Total number of packets** & 3391 & 5253 & 3118 & 3238 & 3217 & 4551 \\ \hline
**Average packet size (bytes)** & 109 & 60 & 89 & 60 & 143 & 60 \\ \hline
**Total size of packet (bytes)** & 370,724 & 315,180 & 277,679 & 194,280 & 461,615 & 273,084 \\ \hline
**Duration of capture (ms)** & 530 & 294 & 253 & 163 & 286 & 271 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Statistical information about network packets of attack scenarios.  
The confusion matrix values in Table 5 were evaluated according to the accuracy metric frequently used in the literature [35]. Accordingly, among the attack types, TCP, SYN, and ICMP Flooding attacks were correctly detected with 100%. The worst detection performance was achieved in the spoofing IP flooding attack with a rate of 84%. For this attack, 423 of 505 samples were correctly detected. In the baseline situation, 459 of 520 samples were determined as not attacked and a high detection rate of 88% was obtained. The UDP flooding attack detection also had a rate close to the non-attack detection rate. The confusion matrix values obtained with the decision tree model were placed in Table 6 and shown below.  
The values in Table 6 were evaluated according to the accuracy metric. As in the HYBRID3b model, all TCP, SYN, and ICMP flooding attacks were correctly detected with 100% in the decision tree model. The UDP flooding attack was the worst-detected attack with 95%. For this attack, 441 of 463 samples were correctly detected. In the baseline situation, 510 of 520 samples were determined as non-attack and a high detection rate of 98% was obtained. Spoofing IP flooding attack detection also had a rate close to the non-attack detection rate.