# Securing Wireless Sensor Networks Using Machine Learning and Blockchain: A Review
## 8 ML and Cyberattack Detection
### Evaluation Metrics  
Two types of cyberattack classifications are present in the literature, based on the number of classes (i.e., attacks): binary classification, in which there are only two classes, attack or normal; and multi-class classification, in which the number of considered classes is greater than two if more than one attack has been detected and sampled in the dataset. In both cases, the testing phase in the process of developing a ML model involves different evaluation metrics, which can include \(P_{d}\), \(P_{fa}\), \(P_{m}\), positive prediction value (PPV), ACC, Error rate (ERR), geometric Mean (GM), root mean square error (RMSE), normalized RMSE, normalized RMSE (NRMSE), receiver operating characteristics (ROC), and \(F1-score\), which can be expressed as follows:\[P_{d}=\frac{T_{P}}{T_{P}+F_{N}}\] \[P_{fa}=\frac{F_{P}}{T_{F}+F_{N}}\] \[P_{md}=\frac{F_{N}}{T_{N}+F_{P}}\] \[\mathit{PPV}=\frac{T_{P}}{T_{P}+F_{P}}\] \[\mathit{ACC}=\frac{T_{P}+T_{N}}{T_{P}+T_{N}+F_{P}+F_{N}}\] \[\mathit{GM}=\sqrt{(P_{d}*P_{md})}=\sqrt{(T_{p}/(T_{p}+F_{P})*T_ {N}/(T_{N}+F_{N}))}\] \[ERR=(1-\mathit{ACC})=\frac{F_{P}+F_{N}}{T_{P}+T_{N}+F_{P}+F_{N}}\] \[F1-score=\frac{2(P_{d}*PVV)}{(P_{d}+PPV)}\]  
where \(T_{P}\), \(T_{N}\), \(F_{P}\), and \(F_{N}\) are the number of true positives, true negatives, false positives, and false negatives, respectively, as per the confusion matrix illustrated in Figure 7.  
These attributes are estimated after dataset testing and are calculated from the generated confusion matrix. \(P_{d}\), called the sensitivity, recall, and detection rate or true positive rate, corresponds to the number of correctly detected attacks vs. the total number of attacks. \(P_{fa}\), or the false alarm rate, corresponds to the number of incorrectly detected attacks vs. the total number of normal traffic instances. \(P_{md}\), or the false negative rate, is the number of undetected attacks vs. the total number of normal traffic instances. ACC is the measure of correctly detected traffic instances, whether normal or attack, vs. the total number of detected samples. ERR is the complement of ACC; it is the misclassification rate, which provides a measure of incorrectly detected traffic instances vs. the total number of detected samples. PPV represents the total number of correctly detected attacks vs. the total number of correctly and incorrectly detected attacks [96]. The F1-score or F-measure represents the harmonic mean of precision and recall; it uses \(F_{N}\) and \(F_{P}\) to efficiently classify noisy or imbalanced data [97]. High ACC, \(P_{d}\), PPV, F1-score, and GM and low \(P_{fa}\) and \(P_{md}\) values generally indicate that an ML model has the potential to accurately detect attacks while ensuring that a low number of attacks go undetected. In addition, RMSE and NRMSE are used to evaluate different cyberattack detection methods numerically, and can be expressed mathematically as  
\[\mathrm{RMSE}=\sqrt{\frac{\sum_{i=1}^{N}(A_{i}-\hat{A_{i}})}{N}*100\%}\]  
\[P_{fa}=\frac{F_{P}}{T_{F}+F_{N}}\]0 Confusion matrix. where \(i\) is the index of the evaluated sample, \(A_{i}\) is the actual value, \(\hat{A}_{i}\) is the estimated or predicted value, and \(N\) is the total number of tested samples. NRMSE is defined as a measure of a model's predictive power against simple prediction using the mean of the observed data, and facilitates comparison between models with different scales; it is calculated as follows:  
\[P_{fa}=\frac{F_{P}}{T_{F}+F_{N}}\]1  
where \(A\) represents the mean of the observed data values, which can be replaced with a range defined as the difference between the maximum and the minimum values of the observed samples. The ROC curve plot indicates the tradeoff between \(P_{d}\) (the \(Y\)-axis) and \(P_{md}\) (the \(X\)-axis). Preferably, the area under the ROC curve should be close to unity; low values are an indication of weak model performance in terms of detection [98]. NRMSE can be interpreted as a fraction of the overall range that is typically resolved by the model.