# Mitigation against DDoS Attacks on an IoT-Based Production Line Using Machine Learning
## 3 Results
### Neural Network  
Neural network evaluates network traffic samples. The logistic regression is designed to predict binary results and uses binomial logistic regression [23]. It is represented by a one-layer neural network [24]. Classification logistic regression is suitable for data processing where binary output is expected. Spark's machine learning (SparkML) provides binomial logistic regression or multinomial logistic regression. It is possible to set up explicitly or it is possible to keep this parameter empty and SparkML library is able to choose one which fits better to the training dataset. The data transformation which was performed in pySpark is a dataset that is used to create a training set. Data are transformed into numerical values and all input parameters merge multiple columns into a vector.  
The value of correlation can be between \(1\) and \(-1\). When it is close to \(1\), it means there is a strong positive correlation. For the dataset used, there were strong positive correlations for INPUTPORT, OUTPUTPORT, and DST_MAC. When the coefficient is close to \(-1\), it means there is a strong negative correlation like ETHERNET_TYPE or also maybe SRC_MAC. The remaining values, around zero, have no linear correlation, and are not suitable for further processing. An overview is given in Table 3, and the heatmap is shown in Figure 6.  
A decision to use the logistic regression algorithm was made in this case. The result indicates one of two states: Either the sample set conforms to the data stream and is marked as allowed, or it is marked as not allowed. The model was learned and a summary of the results is shown in Table 4. The goal is to evaluate the sFlow sample and predict whether its network traffic is safe or not.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Column** & **Correlation** \\ \hline AGENT\_ADRESS & NaN 1 \\ INPUTPORT & 0.6188414212601262 \\ OUTPUTPORT & 0.5909340090255149 \\ SRC\_MAC & \(-\)0.3779526827561006 \\ DST\_MAC & 0.5892544767914198 \\ ETHERNET\_TYPE & \(-\)0.5886118381226132 \\ IN\_VLAN & NaN 1 \\ OUT\_VLAN & NaN 1 \\ SRC\_IP & 0.0840901599517895 \\ DST\_IP & 0.07355890187601573 \\ IP\_PROTOCOL & \(-\)0.07407919159621763 \\ IP\_TOS & NaN 1 \\ IP\_TTL & \(-\)0.05768954593765455 \\ SRC\_PORT\_OR\_ICMP\_TYPE & \(-\)0.0676195969509869 \\ DST\_PORT\_ICMP\_CODE & \(-\)0.042113943046892865 \\ TCP\_FLAGS & \(-\)0.06061824921449012 \\ PACKET\_SIZE & \(-\)0.0733419036600926 \\ IP\_SIZE & \(-\)0.06770010213058673 \\ SAMPLING\_RATE & NaN 1 \\ \hline \hline \end{tabular} 1  
\end{table}
Table 3: Correlation of input parameters.  
Figure 6: Correlation heatmap.  
A test was performed using machine learning library evaluation, specifically the Binary Classification Evaluator. The test dataset was verified, and a final coefficient of 1.0 was obtained, which indicates 100% success. Further validation was performed on the production line during the production process, and the model, which was taught, was further tested in practice.  
The source for the sFlow dataset for the production line is given at the end of the article.