# ZSM Framework for Autonomous Security Service Level Agreement Life-Cycle Management in B5G Networks
## 6 Performance Evaluation
### Reactive Experimental Results  
Regarding the reactive stage performance, we evaluate the system using multiple Key Performance Indicators (KPIs). These include Detection Time (time taken by the monitoring system to identify malicious activity), False Positive Rate (the percentage of benign traffic misclassified as malicious), False Negative Rate (the percentage of malicious traffic misclassified as benign), and Mitigation Time (time taken to detect and neutralize the threat).  
We start with the monitoring probes. Figure 10(a) shows the time it took for the STA detector to identify cryptomining traffic. The results are promising, with an average detection time of just 87.08 milliseconds, demonstrating the efficiency of the detection mechanism. Additionally, Figure 11(a) highlights the occurrences of false positives and false negatives when analyzing a pcap file captured from the 5G core, containing both cryptomining and 5G signaling traffic. With prior knowledge of the expected outcomes, the model achieved an average false negative rate of 0.022% and a false positive rate of 0.013%, reflecting outstanding accuracy. Over 3200 classifications per iteration were performed, and the system consistently exhibited robust performance throughout the experiments. It is important to highlight that in cybersecurity contexts, false positives are particularly significant because they can trigger unnecessary actions within the framework. Our model demonstrates better performance in this regard than other models as explained in [34]. Furthermore, the STA in this scenario is confined to a network slice, resulting in only a minimal number of erroneous values. Nevertheless, it is important to consider the error deviation associated with false positives and apply appropriate threshold quotas to avoid misguided actions that could negatively impact overall system performance. Regarding false negatives, although the results show a minimal detection rate of this kind, in a large-scale system, even a small fraction of undetected cryptomining traffic can translate into significant illicit resource usage. Employing more sophisticated models that leverage multi-layer inspection and incorporating enhanced data quality and variety can further improve detection performance and mitigate the impact of false negatives.  
Finally, Figure 11(b) illustrates the time taken by the system to detect and mitigate the cryptomining attack at both the SMD and E2E levels. Impressively, the attack was mitigated within 20 s at the SMD level and in under 10 s at the E2E level, involving cross-domain interaction. Interestingly, despite requiring more interactions, the E2E mitigation process was quicker. This is because E2E mitigation benefits from a preventive approach, which is triggered at the same time as the alert. In contrast, during the attack, the UMU SMD exhibited a faster response, whereas TID SMD's resources were strained, with nodes overwhelmed by the ongoing attack.  
Figure 10: Time to Detect and AMF Service Downtime. (**a**) Time to Detect; (**b**) AMF Service Downtime.