# A Multi-Model Proposal for Classification and Detection of DDoS Attacks on SCADA Systems
## 4 Materials and Method
### The Performance Analysis Metrics in Attack Detection  
Performance metrics serve for the evaluation and comparison of the deep learning, and the machine learning algorithms for the model. While working on a problem, using \begin{table}
\begin{tabular}{c c c} \hline
**No** & **Features** & **Descriptions** \\ \hline
1 & No & Data number \\ \hline
2 & Time & Time \\ \hline
3 & SourceIP & Source Internet Protocol \\ \hline
4 & DestinationIP & Destination Internet Protocol \\ \hline
5 & SourcePort & Source port \\ \hline
6 & DestinationPort & Destination port \\ \hline
7 & Protocol & Protocol \\ \hline
8 & Length & Data packet length \\ \hline
9 & Info & Information about packet \\ \hline
10 & Modbus\_ByteCount & Modbus protocol data area (in bytes) size \\ \hline
11 & Modbus\_ResponseTime & Modbus protocol response time \\ \hline
12 & Modbus\_ReqFrame & Modbus protocol message format \\ \hline
13 & DeltaTime & Duration between the start and end of an operation \\ \hline
14 & ModbusEventCount & Number of Modbus device transactions \\ \hline
15 & TimeSince\_FirstFrameInThisTCPStream & Time elapsed since the first frame in this TCP stream \\ \hline
16 & TimeSince\_PreviousFrameInThisTCPStream & Time elapsed since the previous frame in this TCP stream \\ \hline
17 & TimeDeltaFromPrevious\_CapturedFrame & Time difference from the previous captured frame \\ \hline
18 & TimeDeltaFromPrevious\_DisplayedFrame & Time difference from the previous displayed frame \\ \hline
19 & TimeSince\_ReferenceOrFirstFrame & Time elapsed since the reference or first frame \\ \hline
20 & FrameLength\_OnTheWire & Frame length on the wire \\ \hline
21 & FrameLength\_StoredIntoTheCaptureFile & Frame length stored into the capture file \\ \hline
22 & TimeToLive & Time to live \\ \hline
23 & TotalLength & Total length \\ \hline
24 & FrameLengthStoredIntoTheCaptureFile & Frame length stored into the capture file \\ \hline
25 & ModbusTCPLength & Modbus TCP packet length \\ \hline
26 & ModbusByteCount & Modbus packet byte count \\ \hline
27 & ModbusTimeFromRequest & Modbus packet time from request \\ \hline
28 & TCPHeaderLength & TCP header length \\ \hline
29 & ModbusRegNum & Modbus register number \\ \hline
30 & Register Value (UINT16) & Modbus register value \\ \hline
31 & Class & Classification column \\ \hline \end{tabular}
\end{table} 
Table 1: Features used in the dataset and their descriptions. these metrics makes it easier to propose more solutions and apply the proposed methods. To determine the most effective method in problem solving, the performance information of each method is obtained one by one. Then the method producing the highest success rate is selected. Table 2 shows the confusion matrix containing the values for performance metrics. The values in the confusion matrix show the actual values and the estimation values [30]. The fact that the value with a positive label in reality also has a positive label in the prediction part makes it a true positive (_TP_). The fact that the value with a negative label is positively labeled in the prediction part makes it a false positive (_FP_). The fact that the value with a positive label is negatively labeled in the prediction portion makes it a false negative (_FN_). The fact that the value with a negative label also has a negative label in the prediction part makes it a true negative (_TN_). The success metrics calculated with the values on the confusion matrix are below. Accuracy is the ratio of the correctly predicted values to the total values. Equation (1) shows this situation:  
\[\text{Accuracy}=\frac{TP+TN}{TP+FP+TN+FN} \tag{1}\]  
Precision is the ratio of the correctly predicted positive values to the predicted values with a positive label. Equation (2) shows this ratio:  
\[\text{Precision}=\frac{TP}{TP+FP} \tag{2}\]  
The recall is the ratio of correctly predicted positive values to the values with a positive label. Equation (3) shows this ratio [31]:  
\[\text{Recall}=\frac{TP}{TP+FN} \tag{3}\]  
F-1 Score--ranging from 0 to 1--is the harmonic mean of precision and recall values.