## 4 Result Discussion and Performance Evaluation
The algorithm was unable to identify the extremely low anomalies in the dataset, which makes it unreliable for real-time detection of MitM attacks. Figure 8a-c show the plot of Python Outlier Detection (PyOD) incorporating interquartile range (IQR), k-nearest neighbor (kNN), and local outlier factor (LOF). The results of this algorithm show high sensitivity in detecting pressure value changes by all three algorithms. Although the IQR could detect extreme high-pressure and low-pressure with high FAR, kNN, and LOF failed to detect extreme high-pressure values correctly. KNN and LOF accuracy of about 70% and a high FAR makes them unsuitable for detecting and mitigating MitM attacks. We applied the same 68,722 real-time SCADA pressure dataset to several other machine learning algorithms and compared their performance metrics, which are accuracy, Receiver operator characteristics (ROC), confusion matrix, training time, misclassification error (MCE), and prediction speed; the outcome is shown in Table 2. Based on these combined machine learning metrics as shown in Table 2, it was concluded that the coarse tree algorithm has significant performance and can detect MitM attacks effectively with negligible FAR. Figure 5: Visualization of the extracted pressure values from the SCADA with and without anomalies. Figure 6: Effect of contamination parameter on the isolation forest algorithm. Figure 7: Effect of batch size variation on the LSTM algorithm. In addition, a thorough comparison was made between the results achieved with the real-time dataset and three public datasets, namely, the WUSTL-2018 [35], ORNL Power Grid [46], and TON_IoT datasets [47]. It is important to state that the FAR recorded with the SCADA was zero as compared to other datasets used by other researchers. The result is shown in Table 3, confirming the superior performance of tree algorithms such as the coarse tree and ensemble tree such as the bagged tree. In addition, although the bagged tree was consistent in most of the datasets in terms of high accuracy, it came with the challenge of high training time justifying the use of the coarse tree where an accuracy-time trade-off is needed. Figure (a)a-c show the plot of the Confusion matrix of the tree algorithm with the best performance using the 68,722 real-time SCADA pressure dataset, which shows zero false positives as compared with other WUSTL and ORNL datasets used by other researchers, which produced 141 and 170 false positives, respectively. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Datasets/Algorithm** & **Accuracy (\%)** & **Training Time (ms)** & **FAR** & **Prediction Speed (obs/s)** \\ \hline
**SCADA Pressure Dataset** & & & & \\ Coarse Tree & 100 & 0.4549 & 0 & 1,000,000 \\ Cubic SVM & 80.2 & 1657.3 & 13,588 & 930,000 \\ \hline
**WUSTL-SCADA-2018 Dataset**[35] & & & & \\ Medium Tree & 100 & 5.6605 & 412 & 4,100,000 \\ Subspace & 93.1 & 101.64 & 72,009 & 110,000 \\ Discriminant & & & & \\ \hline
**ORNL POWER GRID Dataset**[46] & & & & \\ Bagged Tree & 95.1 & 4.8021 & 241 & 2500 \\ Quadratic & 52.4 & 1.6364 & 2339 & 120,000 \\ Discriminant & & & & \\ \hline
**TON\_IoT DATASET**[47] & & & & \\ Bagged Tree & 100 & 1789.5 & 9 & 61,000 \\ Coarse Tree & 82.4 & 94.643 & 81,043 & 1,000,000 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Best and worst-performing machine learning algorithms on various public datasets. Figure 8: Plot of local outlier factor, KNN performance, and interquartile range result. Figure 10a-c shows the plot of the receiver operator characteristics (ROC) curve of the best-performing tree algorithm using the 68,722 real-time SCADA pressure dataset, which shows coarse tree produced the best result with zero false positives and better area under the curve (AUC). In contrast, WUSTL and ORNL showed in the medium tree and bagged tree, respectively, with lesser AUC. Besides the SCADA pressure dataset, the ensemble bagged tree is generally desirable across public datasets when accuracy is considered over another trade-off such as training time.