# A Multi-Model Proposal for Classification and Detection of DDoS Attacks on SCADA Systems
## 4 Materials and Method
### Hybrid-Based Models  
In the other model proposed in the study, LSTM and CNN algorithms were used as a hybrid and analyses were carried out. Three different models (HYBRID1, HYBRID2, and HYBRID3) were prepared using hybrid deep learning. The architecture of the first model (HYBRID1) is shown in Figure 7 as the others were prepared with reference to the first model. In this hybrid model (HYBRID1), deep learning was performed using LSTM and CNN algorithms. Pooling layers and 1-D CNN layers were used. Normalization processes were done and, after the last pooling layer, the LSTM layer was placed in the model. Smoothing, fully connected, classification, and output layers were used. The HYBRID1a model with 200 epochs and the HYBRID1b model with 300 epochs were obtained. In the second hybrid model (the HYBRID2), unlike the HYBRID1, normalization and activation processes were applied twice. Then, the HYBRID2a model was obtained by applying 200 epochs to the model and the HYBRID2b model was obtained by applying 300 epochs to the model. Figure 5: The architecture of the LSTM-based deep learning models. Figure 6: The architecture of the CNN-based deep learning models. The kernel size in the 1-dimensional CNN layers in the HYBRID1 model was increased and the number of filtering operations was reduced. In this way, the HYBRID3 model was obtained. The HYBRID3a model for 200 epochs and the HYBRID3b model for 300 epochs were prepared. Machine Learning Based Models  
When the literature was examined, it was seen that machine learning methods are also used in the detection of attacks on SCADA systems. Algorithms such as random forest, decision tree, logistic regression, Naive Bayes, and KNN were frequently used in the literature. In this study, in addition to deep learning algorithms, machine learning algorithms were also evaluated. Machine learning models were prepared for the detection of DDoS attacks and DDoS attack types for the testbed environment using the SCADA system. The results obtained were given in Table 3. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multicolumn{2}{c}{**Models**} & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1-Score (\%)** \\ \hline \multicolumn{2}{c}{**Deep Learning Based Models**} & & & & \\ \hline \multirow{3}{*}{**LSTM**} & LSTM1a & 84.60 & 86.03 & 84.60 & 83.73 \\ \cline{2-6}  & LSTM1b & 84.28 & 84.63 & 84.28 & 83.63 \\ \hline \multirow{3}{*}{**CNN**} & CNN1a & 93.53 & 94.01 & 93.53 & 93.57 \\ \cline{2-6}  & CNN1b & 94.26 & 94.79 & 94.26 & 94.35 \\ \hline \multirow{3}{*}{**LSTM-CNN HYBRID**} & HYBRID1a & 94.09 & 94.23 & 94.09 & 94.12 \\ \cline{2-6}  & HYBRID1b & 93.97 & 93.99 & 93.97 & 93.97 \\ \cline{2-6}  & HYBRID2a & 93.91 & 94.05 & 93.91 & 93.93 \\ \cline{2-6}  & HYBRID2b & 91.92 & 92.33 & 91.92 & 91.93 \\ \cline{2-6}  & HYBRID3a & 92.77 & 92.99 & 92.77 & 92.82 \\ \cline{2-6}  & HYBRID3b & **94.73** & **94.90** & **94.73** & **94.74** \\ \hline \multicolumn{2}{c}{**Machine Learning Based Models**} & & & & \\ \hline \multirow{3}{*}{**Lazy**} & KStar & 79.93 & 81.93 & 79.95 & 79.03 \\ \cline{2-6}  & LWL & 66.00 & 59.62 & 66.02 & 58.53 \\ \cline{2-6}  & KNN & 86.15 & 86.08 & 86.15 & 86.11 \\ \hline \multirow{3}{*}{**Meta**} & LogitBoost & 83.91 & 88.33 & 83.93 & 83.13 \\ \cline{2-6}  & AdaBoost & 42.96 & - & 43.01 & - \\ \hline \multirow{3}{*}{**Bayes**} & NaiveBayes & 84.03 & 85.43 & 84.00 & 83.54 \\ \cline{2-6}  & BayesNet & 85.24 & 86.44 & 85.20 & 84.82 \\ \hline \multirow{3}{*}{**Rules**} & ZeroR & 22.55 & - & 22.51 & - \\ \cline{2-6}  & PART & 79.24 & 91.32 & 79.23 & 77.14 \\ \cline{2-6}  & DecisionTable & 59.39 & - & 59.40 & - \\ \hline \multirow{3}{*}{**Trees**} & DecisionTree & **98.77** & **98.77** & **98.77** & **98.77** \\ \cline{2-6}  & RandomForest & 95.84 & 97.21 & 95.84 & 96.51 \\ \cline{1-1} \cline{2-6}  & RandomTree & 83.07 & 85.71 & 83.14 & 82.44 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Performance values of the proposed models. Figure 7: The architecture of the hybrid deep learning model (HYBRID1).