## 3 Detection of Cyber-Attacks with Supervised Machine Learning-Artificial Neural Networks
### Deployment of Supervised Machine Learning-Based Artificial Neural Networks
To speed up the training process, it is advantageous to use more powerful hardware, such as a graphics processing unit (GPU), like a Raspberry Pi or NVIDIA Jetson Nano, instead of a central processing unit (CPU). Table 2 outlines the ANN features that have been implemented for each model. Regarding performance metrics for ANNs, ANN-I evaluates its performance using cross-entropy and confusion matrix, as can be seen in Figure 5; however, ANN-II uses mean square error (MSE). The structure of implemented ANNs has one hidden layer, whose sigmoid (Equation (17)) and SoftMax (Equation (18)) activation functions are presented as  
\[f(x)=\frac{1}{1+e^{-x}} \rightarrow r_{tj}=\frac{1}{1+e^{-h_{tj}}} \tag{17}\] \[f(x_{i})=\frac{e^{x_{i}}}{\sum_{k}e^{k}} \tag{18}\]  
where, \(e^{x_{i}}\) expresses the element of output features, the whole denominator (\(i=1\), \(2\), \(3\), \(\ldots\), \(k\), \(\sum_{k}e^{k}=1\)) is the total probability, and lastly \(k\) is the number of attacks. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Parameters** & **ANN-I** & **ANN-II** \\ \hline Number of Input & 2 & 3 \\ Number of Output & 1 & 1 \\ Number of Hidden Neurons & 10 & 10 \\ Number of Delays & NAN & 4 \\ Number of Samples (Training) & 2,800,001 & 2,800,001 \\ Number of Samples (Validation) & 600,000 & 600,000 \\ Number of Samples (Testing) & 600,000 & 600,000 \\ Maximum Number of Episodes & 1000 & 1000 \\ Activation Functions & Sigmoid \& SoftMax & Sigmoid \\ Loss Functions & Cross-Entropy & MSE \\ Hardware of Server PC & NVIDIA GTX GeForce 1080 TI 11 GB GPU \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Specifications of trained ANNs’ structure. Cross-entropy is a broadly utilized loss function for classification issues. It senses the difference between the actual distribution and the estimated probability distribution. In a binary classification problem with labels \(y\in\{0,1\}\) and estimated probability-\(y^{\prime}\), the loss function is formulated as  
\[LF_{CE}=-[y\log(y^{\prime})+(1-y)\log(1-y^{\prime})] \tag{19}\]  
For multi-class classification with \(C\) categories and true labels \(y_{i}\), the loss function is expressed as  
\[LF_{CE}=-\sum_{i=1}^{C}y_{i}\log{y^{\prime}}_{i} \tag{20}\]  
where, \(y^{\prime}_{1}\) is the estimated probability for class \(i\). In parallel, a confusion matrix is utilized to determine the learning performance criteria for the trained network. In multi-class classification with \(C\) classes, the confusion matrix is a \(C\times C\) matrix in which each row represents the actual class, and each column represents the predicted class. As known, the confusion matrix contains correctly predicted true positive cases (_TP_), correctly predicted negative cases (_TN_), incorrectly predicted false positive cases (_FP_), and incorrectly predicted negative cases (_FN_) elements [42]. The obtained accuracy, precision (correct positive predictions), recall (correct true positives), and F-score (stability between recall and sensitivity) are presented as  
\[Accuracy=\frac{TP+TN}{TP+TN+FP+FN} \tag{21}\]  
\[Precision=\frac{TP}{TP+FP} \tag{22}\]  
\[Recall=\frac{TP}{TP+FN} \tag{23}\]  
Figure 5: Confusion matrix of the ANN-I. While green background highlights TP and TN cases, purple one shows distribution percentage. White/gray backgrounds denote FP or FN cases. \[F1 Score=2\times\frac{Precision\times Recall}{Precision+Recall} \tag{24}\]  
To evaluate the performance criteria for the trained network in ANN-II, Equation (25) expresses \(MSE\), which is used as a loss function as  
\[MSE=\frac{1}{n}\sum_{i=1}^{n}e_{i}^{2}=\frac{1}{n}\sum_{i=1}^{n}\left|y_{iref}-y _{i}\right|^{2} \tag{25}\]  
While the best cross-entropy validation performance was obtained as 12.842 \(\times\) 10\({}^{-4}\) at epoch 946 for ANN-I, as seen in Figure 6, the best mean squared error (MSE) validation performance was achieved at 1.0934 \(\times\) 10\({}^{-7}\) at epoch 1000 for ANN-II.