# Time Aware F-Score for Cybersecurity Early Detection Evaluation
## 2 Related Works  
As stated in the previous section, the relevance of the early detection problem has been explored in many fields. Although, a thorough study was proposed there was limited research on its evaluation metrics and methodologies. Best efforts as evaluation metric definition for the early detection problem was presented by _Early Risk Detection Error_\((ERDE)\)[1], _F-latency_[2] an also by [3] where an alternative, _Time aware Precision_\((TaP)\) non-dataset-dependent metric was proposed. At the 2017 CLEF (Conference an Labs for the Evaluation Forum), \(ERDE\) was presented in the workshop for early prediction (_eRisk_) as the metric for the evaluation of the tasks. Then, by using the time-aware proposed metric, participants detection systems for early detection of situations such as depression or other behaviours and disorders using social media network data [1,4]. _F-latency_, a latency-weighted \(F1\), was created to avoid heuristically defined parameters, as it was one of the problems detected by the authors in the definition of \(ERDE\). Those parameters were replaced by dataset defined values for the evaluation of depression detection in social media [5]. _Time aware Precision_\((TaP)\), was presented in [3] based on the study of \(ERDE\) and _F-latency_ as well as other non time aware metrics to overcome problems with the definition of both. Such as, interpretability, better discrimination among results and to obtain a dataset agnostic approach. In a real world environment, where a true streaming evaluation is applied, no data from the full dataset is available, so parameters for the metric must be extracted from the problem. In terms of metrics those three, \(ERDE\)[1] _F-latency_[5] and \(TaP\)[3], are the best effort presented for early detection evaluation with specific latency dependent metrics. Also, it must be mentioned that disregarding specific latency aware metrics, some examples can be found by using traditional metrics like precision, recall or F-score, for the early detection problem. For example [6] or [7], where \(F1\) is measured at specific points without time penalization. Particularly, in the field of network and systems security, early detection of attacks could prevent an increase of the threat minimising the outcome, as presented in [8]. The longer the time passes and the more phases of the attack are achieved, the higher the probabilities of significant damage. As development in this area, several works had been published, such as [9,10] in order to detect attacks at their early stages, usually not taking into account the time in their evaluation. Even, if it is incorporated, usually is just measured by the amount of time until the detection, as shown in [11,12], where a distributed denial of service (DDOS) is targeted. In the early detection in social media some works have been presented to target different aspects of those interactions and the problems that could derive from them. For example, in order to stop as soon as possible the diffusion of fake news and rumours, some solutions are presented as in [13,14] but relying only in the time required for the detection as latency evaluation. This, combined with the increase of cyberbullying [15] and the possible consequences of it and the diffusion and spread of fake news and rumours could lead to depression, self-esteem decrease, suicide ideations or even suicide [16]. Recently, a thorough comparison between different approaches for cyberbullying detection was presented in [17], where as part of machine learning evaluation, LogisticRegression is shown as an alternative. As part of the cyberbullying detection problem, some session based studies had been presented, using specifically Large Language Models (LLM) for the early detection task [18]. Lately, also [19] applies machine learning models as Decision Tree (DT), Random Forest (RF) and AdaBoost (AB) for cybersecurity threats in form of Networks Attacks.