# RDTIDS: Rules and Decision Tree-Based Intrusion Detection System for Internet-of-Things Networks
## 4 Experimentation
### Performance Metrics  
IDS performance is evaluated based on its capability of classifying network traffic into a correct type. Table 4, also known as confusion matrix, shows all the possible cases of classification.  
To evaluate RDTIDS system, we used two groups of metrics. The first group includes specific metrics: the detection rate (DR) of each type of attack and the true negative rate. The second one includes global metrics: global detection rate, false alarm rate (FAR) and accuracy. The following equations summarize how to calculate these metrics.  
\[DR_{AttackType}=\frac{TP_{AttackType}}{TP_{AttackType}+FN_{AttackType}} \tag{2}\]  
\begin{table}
\begin{tabular}{l l l l l l} \hline \hline  & **Category** & **Total** & **Total (-Rows with Lack Info)** & **Training** & **Test** \\ \hline BENIGN & BENIGN & 2,273,097 & 2,271,320 & 20,000 & 20,000 \\ \hline \multirow{4}{*}{DOS} & DDoS & 128,027 & 128,025 & 2700 & 3300 \\  & DoS slowloris & 5796 & 5796 & 1350 & 1650 \\  & DoS Slowhttptest & 5499 & 5499 & 2171 & 1169 \\  & DoS Hulk & 231,073 & 230,124 & 4500 & 5500 \\  & DoS GoldenEye & 10,293 & 10,293 & 1300 & 700 \\  & Heartbleed & 11 & 11 & 5 & 5 \\ \hline PortScan & PortScan & 158,930 & 158,804 & 3808 & 4192 \\ \hline Bot & Bot & 1966 & 1956 & 936 & 624 \\ \hline \multirow{2}{*}{Brute-Force} & FTP-Patator & 7938 & 7935 & 900 & 1100 \\  & SSH-Patator & 5897 & 5897 & 900 & 1100 \\ \hline \multirow{3}{*}{Web Attack} & Web Attack-Brute Force & 1507 & 1507 & 910 & 490 \\  & Web Attack-XSS & 652 & 652 & 480 & 160 \\  & Web Attack-SQL Injection & 21 & 21 & 16 & 4 \\ \hline Infiltration & Infiltration & 36 & 36 & 24 & 6 \\ \hline Total Attack & & 471,454 & 470,365 & 20,000 & 20,000 \\ \hline Total & & 2,830,743 & 2,827,876 & 40,000 & 40,000 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Attack Types in CICIDS 2017 dataset.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Category** & **Attack Type** & **Flow Count** & **Training** & **Test** \\ \hline BENIGN & BENIGN & 9543 & 7634 & 1909 \\ \hline \multirow{2}{*}{Information gathering} & Service scanning & 1,463,364 & 117,069 & 29,267 \\  & OS Fingerprinting & 358,275 & 28,662 & 7166 \\ \hline \multirow{3}{*}{DDoS attack} & DDoS TCP & 19,547,603 & 1,563,808 & 390,952 \\  & DDoS UDP & 18,965,106 & 1,517,208 & 379,302 \\  & DDoS HTTP & 19,771 & 1582 & 395 \\ \hline \multirow{3}{*}{DoS attack} & DoS TCP & 12,315,997 & 985,280 & 246,320 \\  & DoS UDP & 20,659,491 & 1,652,759 & 413,190 \\  & DoS HTTP & 29,706 & 2376 & 594 \\ \hline \multirow{3}{*}{Information} & Keylogging & 1469 & 1175 & 294 \\  & Data theft & 118 & 94 & 24 \\ \hline Total & / & 73,370,443 & 5,877,647 & 1,469,413 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Attack Types in Bot-IoT dataset.  
\[TNR_{BENIGN}=\frac{TN_{BENIGN}}{TN_{BENIGN}+FP_{BENIGN}} \tag{3}\]  
\[FAR=\frac{FP_{BENIGN}}{TN_{BENIGN}+FP_{BENIGN}} \tag{4}\]  
\[DR_{Overall}=\frac{\sum TP_{Of-Each-Attack-Type}}{\sum TP_{Of-Each-Attack-Type}+ \sum FN_{Of-Each-Attack-Type}} \tag{5}\]  
\[Accuracy=\frac{\sum TP_{Of-Each-Attack-Type}+TN_{BENIGN}}{\sum TP_{Of-Each-Attack- Type}+\sum FN_{Of-Each-Attack-Type}+TN_{BENIGN}+FP_{BENIGN}} \tag{6}\]