# Enhancing Cloud Computing Analysis: A CCE-Based HTTP-GET Log Dataset
## 6 The Proposed HTTP-GET Log CCE Dataset Methodology
### Dataset Evaluation
#### 6.4.1 Evaluation Metrics  
The proposed dataset was evaluated by using nine evaluation metrics to demonstrate the Log-based dataset representation's effectiveness and features. These metrics are the True Positive Rate (TPR), False Positive Rate (FPR), precision, recall, F1 score (F-Measure), Matthews Correlation Coefficient (MCC), Receiver Operating Characteristics (ROC), precision-recall (PRC), and detection accuracy (DA).  
Figure 6: Example of WEKA dataset’s SMOTE balancing technique.  
The power to successfully classify attack records as an attack from all of the existent attacks is measured by the _DA_. Equation (2) [39] can be used to compute the _DA_:  
\[DA=\frac{TP+TN}{TP+TN+FP+FN}*100\% \tag{2}\]  
where _TP_ = True Positive, _FN_ = False Negative, _FP_ = False Positive, and _TN_ = True Negative.  
The failure rate of classifying normal requests (instances falsely classified as a given class) as normal requests from the total number of normal requests is known as the _FPR_. Equation (3) can be used to calculate the _FPR_:  
\[FPR=\frac{FalsePositive}{FalsePositive+TrueNegative}*100\% \tag{3}\]  
Precision is another evaluation metric that represents the value of correct positive outcomes divided by the classifier's predicted number of positive results, computed by using Equation (4):  
\[Prec=\frac{TruePositive}{TruePositive+FalsePositive} \tag{4}\]  
All the positive samples that should have been reported (recall) are calculated by dividing the number of valid positive results by the total number of relevant samples and can be computed by using Equation (5):  
\[Rec=\frac{TruePositive}{TruePositive+FalseNegative} \tag{5}\]  
The accuracy of a test is verified by the F-Measure. The Harmonic Mean of the precision and recall is the F-Measure (calculated based on the precision and recall). The F-Measure has a range of [0, 1]. It indicates how robust the classifier is (it does not ignore a large number of instances) along with its precision (how many instances it successfully classifies). High precision but low recall offers an incredibly accurate result but also misses many difficult-to-classify instances. The higher the F-Measure, the better the model's performance. The F-Measure aims to figure out a balance between both precision and recall. It can be stated mathematically as Equation (6):  
\[F1 score=\frac{2*Prec*Rec}{Prec+Rec} \tag{6}\]  
The correlation coefficient for _MCC_ represents a measure of quality between the dependent classes. Unlike sensitivity (recall), precision, and accuracy, its value ranges from minus one to one. A value near minus one indicates a weak prediction, a zero value indicates a fully random prediction, and a value near one indicates a strong and good performance prediction. It can be stated mathematically as Equation (7):  
\[MCC=\frac{TP*FN-FP*FN}{(TP+FP)(TP+FN)(TN+FP)(TN+FN)} \tag{7}\]  
The ROC area measurement is a measure of classifier performance, and several plots provide visual representations. It is one of the essential values output by WEKA. It gives an idea of how the classifiers are performing in general. But, interpreting ROC curves requires particular caution when used with imbalanced datasets.  
When evaluating binary classifiers on unbalanced datasets, the PRC plot is more informative than the ROC plot, which is a graph depicting the tradeoff between the TPR and FPR. Basically, we calculate the TPR and FPR for each threshold and plot them on a single chart. Naturally, the higher the TPR and the lower the FPR for each threshold, the better; therefore, classifiers with more top-left side curves are better.  
The TPR, also known as the sensitivity, measures how accurate a test is. The TPR is the probability that an actual positive will test positive (instances correctly classified as a given class).