# Network Attack Classification in IoT Using Support Vector Machines +
## 4 SVM Models Training and Evaluation
### Evaluation of the SVM Models
In other words, Recall indicates the percentage of the alarms that were correctly classified as malicious. The TPR is usually accompanied with the Precision, or Positive Predictive Value (PPV), that shows the ability to correctly identify the malicious nodes within the network (see Equation (11)) [17]. The Precision/PPV has also been used with the name Detection Rate in certain works [15; 18]. The Accuracy (ACC) value shows the ratio of correct classification of the input local node activity, to either benign or malicious activity, over the total local node activity used for the specific experimental analysis (see Equation (12)). This metric was used in [11; 14; 16; 17]. We also consider the Matthews Correlation Coefficient (MCC) which, unlike the F1 metric, uses all types of alarms to quantify the detection model's classification quality. The MCC also normalizes of the two classes to avoid unequal classification rates. The MCC returns a value between \(-1\) and \(1\), the latter being the worst case scenario in which the model cannot determine the nature of the activity at all, \(0\) indicating that the detection could have also been achieved randomly, and \(1\) that the model can classify the activity at all times. Tables 8-21 show the evaluation results of the SVM detection models. The C-SVM detection model has consistently achieved higher performance rates compared to the OC-SVM. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & & \multicolumn{2}{c}{**True Diagnosis**} \\ \cline{3-4}  & & **Viral** & **Benign** \\ \hline \multirow{2}{*}{True Condition} & Viral & True Positive (TP) & False Negative (FN) \\ \cline{2-4}  & Benign & False Positive (FP) & True Negative (TN) \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Confusion Matrix. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & & \multicolumn{2}{c}{**True Diagnosis**} \\ \cline{3-4}  & & **Viral** & **Benign** \\ \hline SF-FR & Viral & \(15\) & \(5\) \\ \cline{2-4}  & Benign & \(1\) & \(19\) \\ \hline \hline \end{tabular}
\end{table} 
Table 8: C-SVM model: SF-FR. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & \multicolumn{3}{c}{**True Diagnosis**} \\ \cline{3-4}
**Evaluation Set** & **Viral** & **Benign** \\ \hline SFBH-FN & Viral & 20 & 0 \\ \hline Benign & 0 & 20 \\ \hline Accuracy ratio (ACC) = 1, Recall/TPR = 1, Precision/PPV = 1, MCC = 1. & \\ \hline \hline \end{tabular}
\end{table} 
Table 12: C-SVM model: SF&BH-FR. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & \multicolumn{3}{c}{**True Diagnosis**} \\ \cline{3-4}
**Evaluation Set** & **Viral** & **Benign** \\ \hline SFBH-BN & Viral & 20 & 0 \\ \hline Benign & 0 & 20 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: C-SVM model: SF-BN. \begin{table}
\begin{tabular}{c c c} \hline \hline  & \multicolumn{3}{c}{**True Diagnosis**} \\ \cline{3-4}
**Evaluation Set** & **Viral** & **Benign** \\ \hline SFBH-FN & Viral & 20 & 0 \\ \hline \hline \end{tabular}
\end{table} 
Table 13: OC-SVM model: SF&BH-FR. \begin{table}
\begin{tabular}{c c c} \hline \hline  & \multicolumn{3}{c}{**True Diagnosis**} \\ \cline{3-4}
**Evaluation Set** & **Viral** & **Benign** \\ \hline SFBH-FN & Viral & 20 & 0 \\ \hline Benign & 0 & 20 \\ \hline Benign & 14 & 6 \\ \hline Accuracy ratio (ACC) = 0.417, Recall/TPR = 0.759, Precision/PPV = 0.44, MCC = \(-\)0.194. & \\ \hline \hline \end{tabular}
\end{table} 
Table 12: C-SVM model: SF&BH-FR. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & \multicolumn{3}{c}{**True Diagnosis**} \\ \cline{3-4}
**Evaluation Set** & **Viral** & **Benign** \\ \hline SFBH-FN & Viral & 20 & 0 \\ \hline \hline \end{tabular}
\end{table} 
Table 13: OC-SVM model: SF&BH-FR. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & \multicolumn{3}{c}{**True Diagnosis**} \\ \cline{3-4}
**Evaluation Set** & **Viral** & **Benign** \\ \hline SFBH-FN & Viral & 20 & 0 \\ \hline Benign & 0 & 20 \\ \hline Benign & 14 & 6 \\ \hline \hline \end{tabular}
\end{table} 
Table 11: OC-SVM model: SF-BN.