# Routing Attacks Detection in 6 LoWPAN-Based Internet of Things
## 5 Experiment Setup and Results
### Model Results and Evaluation  
Table 5 reveals the confusion matrix for a two-class classifier. The instances in a predicted class are represented in each column of the matrix, while the occurrences in an actual class are represented in each row.  
This model will be evaluated based on the following standard performance measures.  
True Positive Rate (\(TPR\)), also known as Detection Rate (\(DR\)) or Sensitivity, is determined by dividing the number of accurately identified attacks by the total number of attacks. Achieving a \(TPR\) of 1, which means all intrusions are detected correctly, is highly unlikely for an \(IDS\). In summary, \(TPR\) is given by the following formula:  
\[TPR=\frac{TP}{TP+FN}\]  
False Positive Rate (\(FPR\)) is computed by dividing the number of normal instances identified as attacks by the total number of normal instances. Mathematically, \(FPR\) can be expressed as follows:  
\[FPR=\frac{FP}{FP+TN}\]  
When an anomaly is not detected by the system and is mistakenly classified as normal, it is referred to as a false negative. The False Negative Rate (\(FNR\)) is calculated as follows:  
\[FNR=\frac{FN}{FN+TP}\]  
\begin{table}
\begin{tabular}{c c c c} \hline \hline  & & \multicolumn{2}{c}{**Predicted Class**} \\ \cline{3-4}  & & Normal & Anomaly \\ \cline{2-4}  & Normal & True Negative (TN) & False Positive (FP) \\ \cline{2-4}  & Anomaly & False Negative (FN) & True Positive (TP) \\ \hline \hline \end{tabular}
\end{table}
Table 5: Confusion matrix for an anomaly detection system.  
The Classification Rate (CR) or Accuracy of an IDS refers to the ability of the system to correctly identify both normal and abnormal traffic behavior. It is computed by dividing the total number of correctly classified instances based on the baseline behavior features by the total number of instances, expressed as a percentage. In other words, the CR can be defined mathematically as:  
\[Accuracy=\frac{TP+TN}{TP+TN+FP+FN}\]  
The F-measure (_FM_) is an evaluation metric that provides a single accuracy measure for a given threshold by calculating the harmonic mean of the Precision and Recall at that threshold. It is particularly useful when only one accuracy metric is needed to evaluate the performance of the system.  
\[F-measure=\frac{2*Recall*Precision}{Recall+Precision}\]  
Table 6 displays the confusion matrix for a two-category classifier. The matrix is arranged such that the rows represent the instances that belong to each actual class, while the columns represent the examples that belong to each predicted class.  
To evaluate the performance of the system in this study, the dataset was divided into \"k\" distinct parts using the k-fold cross-validation method. In each cycle of this process, one fold was selected randomly for testing, while the other (k-1) folds were used for training. To achieve low bias, low variance, low overfitting, and accurate error estimation, k was set to 10 for each experiment. The dataset was partitioned into ten distinct folds, each representing the entire dataset. The learning process was executed ten times on different training sets, and the resulting error rates were averaged to obtain an estimate of the overall error. The accuracy measures used to evaluate the performance of the classifiers and the confusion matrix, which present examples that belong to a predicted class and the instances that belong to an actual class, are displayed in Table 7, including TP, FP, FN, and TN.