# Anomaly Detection in 6G Networks Using Machine Learning Methods
## 5 Research Methodology
### Confusion Matrix in Binary  
Three datasets are used to implement the HABBAs. Each class, which has both normal and anomalous traffic, is manually applied to the confusion matrix. The given CFS-RF and HABBAs are submitted to the FSs (i.e., features 13, 30, 35, and 40) to detect intrusions. The confusion matrix is a kind of matrix often used in ML to evaluate the performance of algorithms. It summarizes the total correct and incorrect values predicted by the machine learning algorithms, as shown in Table 2.  
Details of the confusion matrix:  
* Positive (P): Actually, positive. * Negative (N): Actually, it is not positive. * True Positive (TP): Actually positive and predicted as positive. * False Negative (FN): Actually positive but predicted as negative. * True Negative (TN): Actually negative and predicted as negative. * False Positive (FP): Actually negative but predicted as positive. The concept uses the binary class form of a confusion matrix. The NSL KDD classes are subject to suggestions. Tables 3 and 4, and Table 4 show the NSL KDD implementation using 30 FS as a binary class. In this FN, the four states are designated as true positive rate (TPR), false positive rate (FPR), true negative rate (TNR), and FNR. These four statuses affect the system's performance metrics. The tables demonstrate how the confusion matrices account for assault frequency and class distribution, demonstrating that the optimal combination of 30 attributes yields the best outcomes. The NSL KDD confusion matrix for 30 features is shown in Table 3. The best FS is the 30-feature subset, as shown by Table 3's explanation of the NSL KDD binary type. For 35 features from the UNSW NB2015 dataset, see Table 4's confusion matrix. Forty features from the CIC IDS2017 dataset are listed in Table 5 as confusion matrices. The confusion matrix for 40 features from the CICDDOS2019 dataset is shown in Table 6. \begin{table}
\begin{tabular}{c c c} \hline \hline  & **Class 1 Predicted** & **Class 2 Predicted** \\ \hline Class 1 actual & TP & FN \\ Class 1 actual & FP & TN \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Confusion Matrix for Binary class. \begin{table}
\begin{tabular}{c c c} \hline \hline  & **Prediction** & \\ \hline  & Benign & Attack \\ Benign & 2886 & 0 \\ Attack & 1 & 9715 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: 30 features NSL_KDD confusion matrix. ```
Begin  Training part: 1. Algorithms for AdaBoosting Initialization: k = 2 (RF, SVM methods), Wi = 0/weight of each class; The classifiers are Ci. 2. Looping /* Equation (7) is used to determine Mi/, which stands for error rate, to modify classifiers (Ki) for each i = 1. 3. If Mi > 0.5 then/* in the event that the error rate exceeds 0.5 */ For each procedure, Equation (8) is used to calculate (Wi). Compute each adjusted Classifier's prediction using Ci = Mi. Wi is added by Ci (i.e., RF and SVM) for every pair of classifiers. 4. End If 5. It is finished up until the two classifiers. 6. Return Minimum Mi, 7. Algorithms for Bagging: 8. Looping:/* SVM and RF are examples of modified classifiers Ci. */ applied the ensemble principle using a bootstrap model to each Ci. The voting concept is applied using Equation (9). It is finished up until the two classifiers. Test component: (Do the actions below)
```  Looping To obtain both Xi-After and If Xi-Before, the accuracy for each (prediction) after and before is computed after voting. 9. Replacement process: 10. If Xi-Before is greater than Xi-After (averaging votes with the greatest likelihood). 11. else  The computation of FAR, FNR, DR, and accuracy  End else 12. End if until the terminating requirement has been met. 13. Return Observations and a combined model. End ```
```  Prediction
```  
**Algorithm 3** Combining HABBAs to detect intrusions  
Different datasets are utilized to find new attacks, strengthening the system's defenses against outside threats (zero-day threats).