# Machine-Learning-Enabled Intrusion Detection System for Cellular Connected UAV Networks
## 5 Experimental Results  
### Experimental Setup  
In this sub-section, we discuss the experimental setup. We use Python programming language because, it is easy to use and is a desired application development platform for many application areas. Python has many ML libraries, including internet protocols, string operations, web services tools, and operating system interfaces. In Python, Scikit-Learn is available, which is an open-source library. It permits implementation of several ML algorithms such as classification and clustering. Some of the libraries used to process the datasets are Pandas, Numpy, and Sklearn. In particular, n-fold cross-validation (usually 10-fold) and train-test split (normally 70-30 or 80-20) are two typical schemes for evaluating machine learning models. When the number of samples in certain categories is small or disproportionate, n-fold cross-validation is typically employed, but the train-test split is often used when the dataset has a significant number of samples in each category. We \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Category** & **Attack** & **Number** & **Train** & **Test** \\ \hline \multirow{3}{*}{**Botnet**} & Bot & 286,191 & \multirow{3}{*}{838,860} & \multirow{3}{*}{209,715} \\ \cline{2-4}  & Benign & 762,384 & & \\ \hline \multirow{6}{*}{**Dos**} & GoldenEye & 41,508 & \multirow{6}{*}{1,677,719} & \multirow{4}{*}{419,430} \\ \cline{2-4}  & Hulk & 461,912 & & \\ \cline{2-4}  & SlowHTTPtest & 139,890 & & \\ \cline{2-4}  & Slowloris & 10,990 & & \\ \cline{2-4}  & Benign & 1,442,849 & & \\ \hline \multirow{6}{*}{**Web**} & Brute Force-Web & 611 & \multirow{6}{*}{1,677,720} & \multirow{4}{*}{419,430} \\ \cline{2-4}  & Brute Force-XSS & 230 & & \\ \cline{2-4}  & SQL Injection & 87 & & \\ \cline{2-4}  & Benign & 2,096,222 & & \\ \hline \multirow{2}{*}{**Infilteration**} & Infilteration & 161,934 & \multirow{2}{*}{755,336} & \multirow{2}{*}{188,835} \\ \cline{2-4}  & Benign & 782,237 & & \\ \hline \multirow{6}{*}{**BruteForce**} & FTP-BruteForce & 193,360 & \multirow{6}{*}{838,860} & \multirow{2}{*}{209,715} \\ \cline{2-4}  & SSH-Bruteforce & 187,589 & & \\ \cline{1-1} \cline{2-4}  & Benign & 667,626 & & \\ \hline \multirow{6}{*}{**DDoS**} & HOIC & 686,012 & \multirow{6}{*}{209,715} \\ \cline{2-4}  & LOIC-UDP & 1730 & & \\ \cline{1-1} \cline{2-4}  & Benign & 360,833 & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Table of attack records. used cross-validation with 10 folds in this paper. As mentioned in the previous sections, logistic regression, linear discriminant analysis, KNN, decision tree, and Gaussian Naive Bayes have been used and compared in terms of accuracy, precision, recall, F1 Score, false negative rate, etc. A confusion matrix, which is also known as an error matrix, includes prominent information about real and predicted output classes. A confusion matrix is a table that is used to represent the output of a classification model (or \"classifier\") on a collection of test data whose true values are known. The outcomes of the classification are divided into two classes, i.e., correct and incorrect classes. The confusion matrix for the intrusion detection is given in Table 2. A confusion matrix with specific layout visualizing the performance of ML algorithm is created for each ML classifier. The main elements of the confusion matrix are presented as follows:  
* True Positive (TP): A TP rate shows the number of attack packets that are correctly classified as attacks. * True Negative (TN): The number of normal packets that correctly classified as normal packets is known as the TN rate. * False Negative (FN): FN is an incorrect classification where the attack packets are considered normal packets. The FN rate will increase when the number of attack packets that are incorrectly classified as normal packets grows, such it will be anticipated that a serious problem occurs in network resources in terms of confidentiality and availability. * False Positive (FP): FP refers to when the normal packets are incorrectly classified as the attack packets.