# Enhancing Security in Smart Robot Digital Twins Through Intrusion Detection Systems
## 4 Test Architecture and System Implementation
### Cicids2017  
Having the dataset at hand, we have classified it in Table 1. The 15 tags (labels) for each traffic class category are presented. The 'benign' class represents regular, non threatening traffic, while the other classes signify various types of malicious activities. Additionally, a separate class called'malign' has been created, encompassing all malicious activities captured. For the experimental evaluation, we applied Random Forest (RF) and Support Vector Machine (SVM) algorithms to the CICIDS2017 dataset for attack detection. We have decided to use two types of algorithms, namely RF and SVM, and the reasons are illustrated below. Firstly, RF [30] presents the following advantages:  
* Robustness to Overfitting: RF is less likely to overfit compared to other algorithms because it constructs multiple trees and merges their outcomes, providing a more generalized model. * Handling High Dimensionality: It can manage many input variables without variable deletion, making it ideal for our datasets. * Importance of Features: It provides an excellent means to measure the importance of each feature in classification, helping to understand which features are most influential in intrusion detection. * Performance: Known for its accuracy and efficiency on large databases, RF can process large amounts of data quickly and effectively, which is essential within an IDS. Algorithms such as Decision Trees are more prone to overfitting and less effective in handling the complexity of network traffic data. However, Neural Networks require significant amounts of data to train effectively without overfitting. Secondly, SVM [31] also presents the following advantages:  
* Effectiveness in High-Dimensional Spaces: SVM is effective when the number of dimensions exceeds the number of samples, which is beneficial for datasets like ours that include detailed features of network traffic. * Memory Efficiency: Its use of a subset of training points in the decision function (support vectors) makes it memory-efficient. * Versatility: SVM can model non-linear boundaries using different kernel functions, allowing it to adapt to various forms of data intuitively and flexibly. * Optimal for Binary Classification: Considering the classification needed between benign and malicious traffic, SVM is particularly well-suited for this task due to its focus on maximizing the margin between classes. \begin{table}
\begin{tabular}{c c} \hline \hline
**Class** & **Count** \\ \hline Benign & 2,271,320 \\ Malign & 556,556 \\ Bot & 1956 \\ DDoS & 128,025 \\ DoS GoldenEye & 10,293 \\ DoS Hulk & 230,124 \\ DoS Slowhttptest & 5499 \\ DoS Slowloris & 5796 \\ FTP-Patator & 7935 \\ HeartBleed & 11 \\ Infiltration & 36 \\ PortScan & 158,804 \\ SSH-Patator & 5897 \\ Web Attack—BruteForce & 1507 \\ Web Attack—Sqllnjection & 21 \\ Web Attack—XSS & 652 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Illustrated classes from the dataset of CICIDS2017. Although K-Nearest Neighbors (KNN) can be straightforward and effective in classification problems, it struggles with large datasets. Logistic Regression, while useful in binary classification problems, does not perform as well on non-linear problem spaces without feature transformation. The choice of SVM and RF algorithms over convolutional or recurrent neural models was supported by several reasons that we will illustrate in the following lines. Firstly, RF and SVM models are less computationally complex compared to CNNs and RNNs. This characteristic makes RF and SVM more suitable for real-time implementations, where system resources and response time are critical. On the other hand, training CNNs and RNNs can be extremely time-consuming and requires massive datasets, whereas SVM and RF can be efficiently trained with smaller datasets and are also easier to calibrate, significantly reducing development and implementation time.