# Machine-Learning-Enabled Intrusion Detection System for Cellular Connected UAV Networks
## 5 Experimental Results
### Results  
In general, for IDS, recall and precision values are appropriate choices, but other important values including FP rate and FN rate, are serious factors. In IDS, FN and FP parameters should possibly be reduced, specifically, the FN parameter, which demonstrates that the portion of attacks classified as legitimate packets. According to the definition of precision, when the value of precision is low, it means the classifier has a high percentage of false-positive value. Hence, many normal packets are classified as attack packets, so it has a lower effect in comparison to the FN rate. For a better understanding of recall parameter, the lower percentage of it can be interpreted that the value of FN is high, and thus the huge portion of attacks can be found as a normal packet that shows this kind of classifier has a large value of attack classification process. In terms of F1 score, a higher value of F1 score means fewer incorrectly classified packets (i.e., normal-to-attack and attack-to-normal) and vice versa. Accuracy rate indicates correctly classified normal and attack packet to the total packets. A Botnet attack is the first attack that was evaluated with the above-mentioned ML algorithms. As can be seen in Table 3, KNN and DT classifier have similar output, but DT has better FNR and incorrectly classified packet. K-M has the worst accuracy rate and the highest incorrect classification value. In Table 4, we present the evaluation of DoS attacks with respect to various ML algorithms. The DT and KNN indicate high accuracy rates with the highest correctly classified data, respectively. The DT has 0 FNR with 1 precision, recall, and F1-score value. \begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Confusion Matrix**} & \multicolumn{3}{c}{**Prediction**} \\ \cline{2-4}  & \multicolumn{2}{c}{**Positive Class**} & **Negative Class** \\ \hline \multirow{2}{*}{Actual} & Normal & TP & FN \\ \cline{2-4}  & Anomaly & FP & TN \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Confusion Matrix. did not reach the maximum value of the accuracy rate, and it achieved the lowest FN rate and it needed low time demand for creating the training model. Table 7 presents Brute Force Attack, where we can see the highest accuracy rate for DT, KNN, and LDA classifier at 99.99%, 99.96%, and 99.77%, respectively. However, among all of them, GNB shows the highest FNR value, 0.64, and has the lowest accuracy rate of 59.26%. Moreover, the LR algorithm has a higher FNR of 0.155, which means that LR can incorrectly classify attack packets as normal packets. For the DDoS attack give in Table 8, all ML algorithms showed excellent performance based on accuracy rate, precision, recall, and F1 score. The K- M classifier performed the worst in detecting DDoS attacks based on different metrics, and it was the worst classifier to be used to detect a DDoS attack. It obtained the lowest accuracy rate of 34.39% with an FNR value of 0.005, which can be interpreted as showing that there were a number attacks classified as having a normal value. \begin{table}
\begin{tabular}{l l l l l l l l} \hline \hline
**Infiltration** & **AR** & **P** & **R** & **F1** & **FNR** & **CC** & **IC** \\ \hline LR & 82.76\% & 0.759 & 0.003 & 0.005 & 0 & 156,292 & 32,543 \\ \hline LDA & 82.86\% & 0.583 & 0.026 & 0.05 & 0.004 & 156,475 & 32,360 \\ \hline KNN & 80.29\% & 0.431 & 0.443 & 0.437 & 0.122 & 151,630 & 37,205 \\ \hline DT & 86.57\% & 0.616 & 0.59 & 0.603 & 0.077 & 163,490 & 25,345 \\ \hline GNB & 22.67\% & 0.175 & 0.939 & 0.295 & 0.922 & 42,822 & 146,013 \\ \hline SGD & 82.53\% & 0.231 & 0.005 & 0.01 & 0.003 & 155,860 & 32,975 \\ \hline K-M & 74.76\% & 0.148 & 0.097 & 0.118 & 0.117 & 141,176 & 47,659 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Infiltration Attack.