## 4 Evaluation and Performance Optimization
### Feature Engineering
Thus, adversarial accuracy (Equation (2)) can be defined as follows:  
\[Accuracy=\left(\frac{\text{Correct }Predictions\text{ on }Adversarial\text{ Samples}}{\text{Total }Adversarial\text{ Examples}}\right)\times 100 \tag{2}\]  
Therefore, a higher adversarial accuracy indicates a higher robustness level against the specific attacks used to generate the adversarial samples. RF and XGBoost are both tree-based algorithms that utilize decision trees to construct robust models for regression and classification objectives, demonstrating significant effectiveness in the analysis of structured data. Besides their shared foundation in decision trees, these algorithms show different methodologies in the structure and combination of trees to attain superior predictive accuracy. Overall, both RF and XGBoost demonstrate capability in tree-based modeling, particularly for structured data, yet they fulfill somewhat distinct functions. The independence characteristic of RF among trees positions it as a reliable option when interpretability and computational efficiency are paramount; whereas, the sequential boosting architecture of XGBoost frequently yields enhanced accuracy, albeit with increased computational demands and a heightened necessity for meticulous tuning. In this approach, we modified the adversarial sample generation process using GA to craft more sophisticated evasion samples tailored to bypass standard detection systems. The GA iteratively optimized adversarial examples by evolving attack patterns, mutating features, and selecting adversarial samples that most successfully evaded detection. This generated dataset of adversarial samples was then evaluated against models built with RF, XGBoost, aiming to test and enhance their robustness against evasion attacks. Table 4 presents the important features from RF (without GA, 40), (with GA, 29), while the important features from XGBoost (without GA, 13), (with GA, 8). By using GA-generated adversarial data, we were able to simulate real-world evasion scenarios, where attackers might manipulate features to avoid detection. Testing these adversarial examples on RF and XGBoost models allowed us to assess their resilience, leveraging RF's stability and XGBoost's accuracy in complex, potentially invasive data patterns. In Figure 8, the ART adversarial attack classifiers present the resilience of GAORed features and other features without GAOR. The performance of RF, XGBoost, and their modified versions was evaluated in the context of adversarial attack detection. ZooAttack with XGBoostClassifier represents standard attacks, while ZooAttack with LightGBMClassifier reflects more sophisticated adversarial attack. A No_Model was also assessed for comparison. Here is the summary of their accuracies, as follows:  
ZooAttack with XGBoostClassifier--RF achieved 100% accuracy, successfully detecting all standard adversarial attacks, indicating robustness against simpler attack patterns. XGBoost matched RF with 100% accuracy, showcasing equivalent resilience against ZooAttack with XGBoostClassifier attacks. Surprisingly, the \"No Model\" also achieved 100%, suggesting that attacks in ZooAttack with XGBoostClassifier might have distinctive, easily detectable features, making them straightforward to identify. RF-GAORed's accuracy dropped to 60%, implying that the modifications impaired RF's ability to detect adversarial patterns, while XGBoost-GAORed's accuracy declined further to 40%, indicating a substantial reduction in effectiveness after modification. ZooAttack with LightGBMClassifier--RF recorded a reduced accuracy of 40%, struggling to cope with the complexity of the attacks in ZooAttack with LightGBMClassifier. XGBoost performed better than RF with an accuracy of 80%, demonstrating superior adaptability to sophisticated adversarial strategies. \"No Model\" had 0% accuracy, underscoring that the attacks in ZooAttack with LightGBMClassifier require a dedicated classifier for meaningful detection.