# A Lightweight Model for DDoS Attack Detection Using Machine Learning Techniques
## 4 Results and Discussion
### Evaluation Using Metrics  
Many performance metrics are used to evaluate ML- and DL-based IDSs. The research aims to compare the performance when feature selection is used and when it is not. Accuracy is the key measure of evaluation. \[\text{Accuracy}=\frac{\text{TP}+\text{TN}}{\text{TP}+\text{TN}+\text{FP}+\text{ FN}} \tag{5}\]  
Other metrics include recall, precision, F1 score, training time, prediction time, and total time. F1 score takes both FP and FN into account, unlike recall and precision. \[\text{Recall}=\frac{\text{TP}}{\text{TP}+\text{FN}} \tag{6}\]  
Figure 9: (a) ROC curve for TON-IOT all attacks (15 features), KNN; (b) ROC curve for TON-IOT DDoS attacks (15 features), KNN; (c) ROC curve for BOT-IOT all at-tacks (15 features), KNN; (d) ROC curve for BOT-IOT DDoS attacks (15 features), KNN. \[\text{Precision}=\frac{\text{TP}}{\text{TP}+\text{FP}} \tag{7}\]  
\[\text{F1 Score}=\frac{2*\text{Recall}*\text{Precision}}{\text{Recall}+\text{ Precision}} \tag{8}\]  
Discussing the evaluation metrics used for the proposed model, precision is a crucial metric in detecting DDoS attacks in IoT devices, as it measures the accuracy of identifying true positives among instances labelled as attacks. It reflects the system's ability to minimize false positives, which occur when normal traffic is wrongly classified as DDoS attacks. High precision indicates a low rate of false positives, ensuring that legitimate IoT services are not disrupted by unnecessary alarms or resource allocation. Balancing precision with other performance metrics is essential for an effective detection system that accurately identifies DDoS attacks while minimizing false positives. Overall, precision plays a significant role in securing IoT networks against DDoS attacks by accurately identifying true positives and reducing false positives. Recall, also known as sensitivity or true positive rate, is crucial for detecting DDoS attacks in IoT devices. It quantifies the system's capability to correctly identify actual DDoS attacks from all the instances that are truly positive. In other words, recall indicates the system's effectiveness in minimizing false negatives, which occur when DDoS attacks go undetected or are misclassified as normal traffic. A high recall rate signifies a low occurrence of false negatives, ensuring that a significant number of DDoS attacks are accurately identified and reducing the risk of leaving malicious activities undetected. In summary, recall plays a critical role in DDoS attack detection for IoT devices by measuring the system's ability to capture actual attacks. Achieving a high recall rate reduces false negatives and enables comprehensive detection, enabling prompt mitigation of attacks. This is a system that safeguards IoT networks against DDoS threats. The F1 score is a very important metric for evaluating the performance of a DDoS attack detection system in IoT devices. It combines precision and recall, providing a balanced assessment of the system's ability to accurately identify DDoS attacks and capture the majority of actual attacks. The F1 score is particularly useful when dealing with class imbalance between normal traffic and DDoS attacks. A high F1 score indicates a robust and reliable detection system that achieves a balance between precision and recall, minimizing false alarms and undetected attacks. Overall, the F1 score is critical for evaluating the effectiveness of DDoS attack detection in IoT devices, ensuring a well-rounded approach that minimizes both false positives and false negatives, thereby securing IoT networks effectively. Accuracy is a crucial metric for assessing the performance of DDoS attack detection in IoT devices. It measures the system's correctness by evaluating the proportion of correctly classified instances, including true positives and true negatives. A high accuracy rate indicates the system's effectiveness in distinguishing between DDoS attacks and normal traffic, reducing false positives and false negatives.