# A Lightweight Model for DDoS Attack Detection Using Machine Learning Techniques
## 4 Results and Discussion
### Logistic Regression  
A supervised machine learning approach used for classification tasks is logistic regression. It is a linear model that converts the input data into a likelihood of belonging to a particular class using a logistic function. The logistic function, also called the sigmoid function, produces values between zero and one on the basis of an s-shaped curve. The approach learns the ideal weights for the input characteristics that minimize the error between the predicted probability and the true labels in order to train a logistic regression model. A method known as maximum likelihood estimate is used for this. By running the input features through the logistic function and categorizing the data based on the resulting probability, the model may be trained to make predictions on new data. The confusion matrix is given below for TONIOT and BOTIOT, representing binary and multiple-class classification for each (Case 1 to Case 4) for 15 features (Table 4). In Case 1, which corresponds to multiple-class classification for the TON-IOT dataset, it is observed that the FN value is higher than the FP value, and therefore there are chances that normal traffic can be detected as an attack. However, the TP and TN values compensate for the FP and FN values, giving a fairly decent accuracy. Similarly, in Case 3 with the BOT-IOT dataset for multiple-class classification with a higher number of records than TON-IOT, there is a fairly high margin with TP and TN values when compared to FP and FN values and hence it gives much higher accuracy. In Cases 1 and 4, with TON-IOT and \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **Case 1 (All Attacks)** & & & **Case 2 (DDoS Attacks)** & \\ \hline True/Predict & Class 0 (Normal) & Class 1 (Attack) & True/Predict & Class 0 (Normal) & Class 1 (Attack) \\ \hline Class 0 (Normal) & 59,922 & 0 & Class 0 (Normal) & 60,015 & 0 \\ Class 1 (Attack) & 0 & 32,287 & Class 1 (Attack) & 0 & 3985 \\
**Case 3 (All Attacks)** & & & & **Case 4 (DDoS Attacks)** & \\ True/Predict & Class 0 (Normal) & Class 1 (Attack) & True/Predict & Class 0 (Normal) & Class 1 (Attack) \\ Class 0 (Normal) & 733,605 & 0 & Class 0 (Normal) & 385,324 & 0 \\ Class 1 (Attack) & 0 & 100 & Class 1 (Attack) & 0 & 97 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Confusion matrix for TONIOT (Case 1 and Case 2), BOTIOT (Case 3 and Case 4), and LR (15 features). \begin{table}
\begin{tabular}{c c c} \hline \hline
**Classifier** & **Hyperparameter** & **Parameter** & **Value** \\ \hline Naïve Bayes & GaussianNB & random\_state & 0 \\ \hline  & model = Sequential() & model.add(Dense(input\_dim=, \\  & model.add(Dense(32, input\_dim=15, \\  & activation = ‘relu’)) & \\ Artificial Neural & activation = ‘relu’) & \\ Network & model.add(Dense(16, activation = ’relu’)) & \\  & model.add(Dense(2, activation = ’softmax’)) & \\  & model.compile(loss = ‘categorical_crossentropy’, \\  & optimizer = “adam’, metrics = [’accuracy’]) & \\ \hline  & & \\ K Nearest & & \\ Neighbour & & \\ \cline{2-3}  & & \\ \cline{2-3}  & & \\ \cline{2-3}  & & \\ \cline{2-3}  & & \\ \end{tabular}
\begin{tabular}{c} model.compile(loss=, \\ optimizer=, metrics=) \\ \hline n\_neighbors & 10 \\ \hline weights & ‘uniform’ \\ \hline algorithm & ‘auto’ \\ \hline metric & ‘minkowski’ \\ \hline metrix\_params & None \\ \hline n\_jobs & None \\ \hline \hline \end{tabular}
\end{table} 
Table 3: _Cont._BOT-IOT datasets for binary classification, both FP and FN values are zero, and therefore tend to receive the maximum accuracy. The subsequent ROC curves are given for BOT-IOT and TON-IOT, with 15 features for multiple-class and binary classifications (Figure 5). It is observed that Figure 5b,d, which correspond to the binary classification for TON-IOT and BOT-IOT, respectively, have steep ROC curves that touch the top left corner, which makes these two cases very good models.