# Network Attack Classification in IoT Using Support Vector Machines +
## 4 SVM Models Training and Evaluation
### Evaluation of the SVM Models  
The end result of the training stages were five C-SVM detection models (one for each attack) and one OC-SVM detection model. The data sets that were used for the evaluation are shown in Table 3.  
To set up our data evaluation sets, we applied the following steps: [13]:  
1. Label data into benign and malicious in the form of vectors \((x_{i},y_{i})\);
2. Apply scaling to the evaluation set;
3. Use as input the evaluation data set within the SVM model compiled at the training stage. Table 6 shows the time in milliseconds for each SVM detector required to classify the evaluation dataset. These times correspond to the processing of the whole dataset. It is anticipated that the classification time required will be even less when the detector is used in real-time, as the detector will classify each monitoring period one at a time. To evaluate the performance of each detection model we classified our results in the form of Confusion Matrix (see Table 7) and use the alarm type classifications to compute the Accuracy rate (ACC), the Recall, Precision and the Matthews Correlation Coefficient (MCC) [12]. \[Recall/TPR=\frac{TP}{TP+FN} \tag{10}\]  
\[Precision/PPV=\frac{TP}{TP+FP} \tag{11}\]  
\[ACC=\frac{TP+TN}{TP+TN+FP+FN} \tag{12}\]  
\[MCC=\frac{TPxTN-FPxFN}{\sqrt{(TP+FP)(TP+FN)(TN+FP)(TN+FN)}} \tag{13}\] \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Attack** & **C-SVM** & **OC-SVM** \\ \hline \multirow{2}{*}{SF} & BN & 6.362 & 1.808 \\ \cline{2-4}  & FR & 0.004186 & 0.002179 \\ \hline \multirow{2}{*}{SF \& BH} & BN & 5.430 & 2.922 \\ \cline{2-4}  & FR & 3.989 & 2.069 \\ \hline \multicolumn{2}{c}{Sinkhole} & 7.892 & 2.976 \\ \hline \multicolumn{2}{c}{Sink in the middle (All attacks)} & 15.903 & 3.841 \\ \hline \multicolumn{2}{c}{Sink on Top (All attacks)} & 27.637 & 7.788 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: SVM evaluation classification time (in ms). \begin{table}
\begin{tabular}{c c c} \hline \hline
**Training Set** & \(\mathbf{C}\) & \(\mathbf{\gamma}\) \\ \hline Selective Forward — Forwarding Ratio & 128.0 & 0.5 \\ Selective Forward — Block Node & 0.03125 & 0.5 \\ Selective Forward + Blackhole — Forwarding Ratio & 0.03125 & 0.0078 \\ Selective Forward + Blackhole — Block Node & 2.0 & 0.0078 \\ Sinkhole & 8.0 & 2.0 \\ All Attacks — Sink in the middle & 128.0 & 0.0078 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: SVM \((\mathbf{C},\mathbf{\gamma})\) values from our training results. Previous work on intrusion detection techniques in network security present their results using various binary classification performance metrics [11; 14; 15; 16; 17; 18; 19; 20]. In IDSs for WSN and the IoT, results are usually presented by using a subset of the binary classification metrics, such as detection rate, true and false positive alarms, and accuracy rate. We propose to use an extended set of performance metrics to provide a better understanding of the suitability and efficacy of the detection models. The binary classification performance measurements are deviations of the alarm types of the system. The alarms raised are quantified and classified as True and False alarms. The True Positive and True Negative values are the correct predictions of the model. \(TruePositive(TP)\) alarms indicate that the model was given an activity that was malicious and was correctly identified. \(TrueNegative(TN)\) values indicate that when given a benign activity, the model correctly identifies it as benign and no alarm is raised. On the contrary, the False Positive/Negative values show the misclassifications of the model. The \(FalsePositive(FP)\) values are the malicious local node activities that were undetected. The \(FalseNegative(FN)\) values are the benign node activities that raised an alarm. Recall, also known as True Positive Rate (TPR), shows the ratio of \(TruePositives\), the alarms that were raised by the malicious nodes, over the total alarms raised (see Equation (10)).