# Security Analysis of DDoS Attacks Using Machine Learning Algorithms in Networks Traffic
## 4 Measurement of Evaluation  
An IDS should predict DDoS attacks with high detection accuracy. There can be significant inclusion for a community when the system does not guarantee success to expose an attack [8]. Table 5 shows a list of the measurement of evaluation. \[TPR=\frac{\sum tp}{\sum DDoS\ attacks\ in\ dataset} \tag{1}\]  
\begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Type** & **Class** & **Description** \\ \hline \multirow{6}{*}{
\begin{tabular}{c} **No. ** \\ **1** \\ **2** \\ **3** \\ **4** \\ **5** \\ **6** \\ **7** \\ **8** \\ **9** \\ **10** \\ **11** \\ **12** \\ **13** \\ **14** \\ **15** \\ **16** \\ **17** \\  
\[FPR=\frac{\sum fp}{\sum\text{{Benign}}\text{{traffic}}\text{{in}}\text{{dataset}}} \tag{2}\]  
\[p=\frac{tp}{tp+fp} \tag{3}\]  
\[r=\frac{tp}{tp+fn} \tag{4}\]  
\[f-measure=\frac{2\times p\times r}{(p+r)} \tag{5}\]  
\[Accuracy=\frac{TP+TN}{TP+TN+FP+FN} \tag{6}\]  
Figure 4 shows the performance metrics of selected algorithms. The best accuracy was found in the DT and RF algorithms. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Selected Algorithm** & **Accuracy** & **Precision** & **Recall** & **F-Measure** & **Computation Time** \\ \hline K\_Nearest\_Neighbors (K-NN) & 0.98 & 0.99 & 0.99 & 0.99 & 3.5 s \\ Super Vector Machine (SVM) & 0.86 & 0.86 & 0.87 & 0.85 & 7.29 s \\ Naïve Bayes (NB) & 0.45 & 0.66 & 0.54 & 0.38 & 1.3 s \\ Decision Tree (DT) & 0.99 & 0.99 & 0.99 & 0.99 & 4.53 s \\ Random Forest (RF) & 0.99 & 0.99 & 0.99 & 0.99 & 84.2 s \\ Logistic Regression (LR) & 0.98 & 0.99 & 0.98 & 0.99 & 5.53 s \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Performance metrics for each algorithms. \begin{table}
\begin{tabular}{c c} \hline \hline
**Symbol** & **Meaning** \\ \hline True Positive (\(tp\)) & It is the amount of DDoS attacks that have been recognized as attacks. \\ True Negative (\(tn\)) & It is the amount of legitimate network traffic instances benign recognized as legitimate. \\ False Positive (\(fp\)) & It is the amount of legitimate network traffic examples benign misidentified as attacks. \\ False Negative (\(fn\)) & It is the amount of DDoS attacks that cannot be defined as legitimate. \\ TPR & The amount of DDoS attacks exposed as attacks is split by the total amount of DDoS attacks in the dataset and is calculated as shown in Equation (1). \\ FPR & Calculated by dividing the amount number of benign instances imperfectly distributed as DDoS attacks by the whole amount number of benign instances in a dataset, and it is calculated as shown in Equation (2). \\ Precision (\(p\)) & Defined as the amount number of \(tp\) among all instances that are forecast to be positive, and it is calculated as shown in Equation (3). \\ Recall (\(r\)) & The percentage of \(tp\) from all instances that are essentially positive and is calculated as shown in Equation (4). \\ _f-measure_ & The weighted harmonic means of precision and recall and is calculated as shown in Equation (5). \\ _Accuracy_ & It is obtained by the equation below, and it displays the model’s exact forecast rate, and it is calculated as shown in Equation (6). \\ \hline \hline \end{tabular}
\end{table} 
Table 5: List of Used Notations. In Table 7, the studies on DDoS attack traffic detection using ML algorithms and the classification model we propose are shown comparatively. When Table 7 is examined, it is seen that different datasets were used to detect attack traffic. Some of the researchers used public datasets containing network traffic data from conventional network topologies [44] such as KDD Cup'99 [45] and UNB-ISCX [46]. The use of these datasets is positive for comparing the performance of ML algorithms used in the detection of attack traffic. The results show that ML models are quite successful in detecting attack traffic. The work in this paper aims to contribute to the research conducted in this field. The experimental results showed that using the random forest regressor (RFR) feature selection methods increases the accuracy of ML methods in detecting attack traffic.