# A Novel Hybrid Unsupervised Learning Approach for Enhanced Cybersecurity in the IoT
## 5 Results
### Experimental Dataset Usage  
Table 3 displays the dataset utilized and the components of selected samples for this study, while Table 4 shows the configuration of hyperparameters. Performance metrics are evaluated to gauge the effectiveness of the intrusion detection model, utilizing a confusion matrix. This assessment includes accuracy, precision, recall, specificity, false negative rate, and F-score. Precision, as defined in Equation (9), measures the accuracy of optimistic predictions. Recall, represented by Equation (10), captures the ability of the model to correctly classify positive instances. Specificity, outlined in Equation (11), provides valuable insights into the model's effectiveness in identifying instances of the negative class accurately. The F-score, presented in Equation (12), offers a comprehensive evaluation metric that balances precision and recall. Accuracy, as indicated in Equation (13), quantifies the proportion of correct classifications made by the model. The false negative rate (FNR), or miss rate, quantifies the percentage of actual positive instances incorrectly identified as negatives by the model, as defined in Equation (14). In evaluating the efficacy of the prevention model, key performance indicators including prevention rate, priority-based blocking rate, and success rate are employed. The prevention rate, as depicted in Equation (15), signifies the proportion of thwarted threats. The priority-based blocking rate, illustrated in Equation (16), focuses on intercepting high-priority threats. Equation (17) measures the overall effectiveness of the model. These \begin{table}
\begin{tabular}{l r} \hline \hline
**Hyperparameter** & **Values** \\ \hline nu(v) & 0.095 \\ Kernel & Gaussian \\ Optimizer & Adam \\ Learning rate & 0.001 \\ Epochs & 40 \\ Batch size & 32 \\ Patience & 8 \\ Latent space & 3 \\ Threshold & 0.0219 \\ Epsilon (\(\varepsilon\)) & 0.2 \\ MinPts & 800 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Hyperparameter configuration. \begin{table}
\begin{tabular}{l l l} \hline \hline  & **CIC-IDS2017** & **CSECIC-IDS2018** \\ \hline Training class & \begin{tabular}{l} Benign, DoS, DDoS, botnet and \\ brute force \\ \end{tabular} & \begin{tabular}{l} Benign, DoS, DDoS, botnet and \\ brute force \\ \end{tabular} \\ Testing class & \
\begin{tabular}{l} Training class + Heartbleed \\ and infiltration \\ \end{tabular} &
\begin{tabular}{l} Training class + web attack \\ and infiltration \\ \end{tabular} \\ Numbers of features & 83 & 80 \\ Number of benign instances & 2,359,087 & 2,374,871 \\ Number of attack instances & 224,893 & 239,842 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Experimental samples. metrics offer valuable insights into the model's ability to mitigate threats and prioritize actions, crucial for effective cybersecurity management and risk mitigation strategies:  
\[Precision=\frac{True\ Positive}{Predicted\ Positives} \tag{9}\]  
\[Recall=\frac{True\ Positive}{True\ Positive+False\ Negative} \tag{10}\]  
\[Specificity=\frac{True\ Negative}{True\ Negative+False\ Positive} \tag{11}\]  
\[F-Measure=\frac{2*(Precision*Recall)}{Precision+Recall} \tag{12}\]  
\[Accuracy=\frac{True\ Positive+True\ Negative}{Predicted\ Positive+Predicted\ Negative} \tag{13}\]  
\[False\ Negative\ Rate=\frac{False\ Negative}{True\ Positive+False\ Negative} \tag{14}\]  
\[Prevention\ Rate=\frac{Number\ of\ detected\ attacks\ mitigated}{Total\ number\ of\ detected\ attacks} \tag{15}\]  
\[Priority\ based\ blocking\ Rate=\frac{Number\ of\ High\ priority\ attacks\ Blocked}{Total\ number\ of\ High\ priority\ attacks\ detected} \tag{16}\]  
\[\ Success\ Rate=\frac{Number\ of\ attacks\ prevented}{Total\ number\ of\ detected\ attacks} \tag{17}\]  
The effective performance of the model hinges on critical elements like the suitable architecture and hyperparameter configurations of the detection model. A series of comprehensive experiments were carried out to identify the most effective hyperparameter configurations.