# A Multi-Model Proposal for Classification and Detection of DDoS Attacks on SCADA Systems
## 5 Experimental Results
### Discussion  
The analysis results of the two models with the highest success rates among the models proposed in the study (deep learning-based and machine learning-based) were compared with the analysis results of the studies in the literature. The results obtained are given in Table 7. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline  & & \multicolumn{6}{c}{**Predicted Class**} \\ \hline  & \multirow{3}{*}{\begin{tabular}{c} **Normal** \\ **(\%)** \\ \end{tabular} } & \multirow{3}{*}{\begin{tabular}{c} **TCP** \\ **Flooding** \\ **(\%)** \\ \end{tabular} } & \multirow{3}{*}{\begin{tabular}{c} **UDP** \\ **Flooding** \\ **(\%)** \\ \end{tabular} } & \multirow{3}{*}{\begin{tabular}{c} **SYN** \\ **Flooding** \\ **(\%)** \\ \end{tabular} } & \multirow{3}{*}{\begin{tabular}{c} **Spooding IP** \\ **Flooding** \\ **(\%)** \\ \end{tabular} } & \multirow{3}{*}{\begin{tabular}{c} **ICMP** \\ **Flooding** \\ **(\%)** \\ \end{tabular} } & \multirow{3}{*}{\begin{tabular}{c} **TP Rate** \\ **(\%)** \\ \end{tabular} } & \multirow{3}{*}{\
\begin{tabular}{c} **FN Rate** \\ **(\%)** \\ \end{tabular} } \\ \cline{2-2} \cline{6-8} \multirow{3}{*}{
\begin{tabular}{c} **Baseline Situation** \\ **TCP Flooding** \\ **(\%)** \\ \end{tabular} } & \multirow{3}{*}{98.08} & \multirow{3}{*}{0.00} & \multirow{3}{*}{0.58} & \multirow{3}{*}{0.00} & \multirow{3}{*}{1.34} & \multirow{3}{*}{0.00} & \multirow{3}{*}{98.10} & \multirow{3}{*}{1.90} \\ \cline{2-2} \cline{6-8}  & & & & & & & & \\ \cline{2-2} \cline{6-8}  & & & & & & & & \\ \cline{2-2} \cline{6-8}  & & & & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Confusion matrix values of the proposed the decision tree model. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline  & & \multicolumn{6}{c}{**Predicted Class**} \\ \hline  & \multirow{3}{*}{\begin{tabular}{c} **Normal** \\ **(\%)** \\ \end{tabular} } & \multirow{3}{*}{\begin{tabular}{c} **TCP** \\ **Flooding** \\ **(\%)** \\ \end{tabular} } & \multirow{3}{*}{\begin{tabular}{c} **UDP** \\ **Flooding** \\ **(\%)** \\ \end{tabular} } & \multirow{3}{*}{\begin{tabular}{c} **SYN** \\ **Flooding** \\ **(\%)** \\ \end{tabular} } & \multirow{3}{*}{\begin{tabular}{c} **Spooding IP** \\ **Flooding** \\ **(\%)** \\ \end{tabular} } & \multirow{3}{*}{\begin{tabular}{c} **ICMP** \\ **Flooding** \\ **(\%)** \\ \end{tabular} } & \multirow{3}{*}{\begin{tabular}{c} **TP Rate** \\ **(\%)** \\ \end{tabular} } & \multirow{3}{*}{\begin{tabular}{c} **FN Rate** \\ **(\%)** \\ \end{tabular} } \\ \cline{2-2} \cline{6-8}  & & 88.27 & 0.00 & 8.65 & 0.00 & 3.08 & 0.00 & 88.30 & 11.70 \\ \cline{2-2} \cline{6-8}  & & **TCP Flooding** & 0.00 & 100 & 0.00 & 0.00 & 0.00 & 100 & 0.00 \\ \cline{2-2} \cline{6-8} \multirow{3}{*}{\begin{tabular}{c} **Actual** \\ **Class** \\ \end{tabular} } & \multirow{3}{*}{\
\begin{tabular}{c} **UDP Flooding** \\ **SYN Flooding** \\ **Flooding** \\ **Flooding** \\ \end{tabular} } & \multirow{3}{*}{
\begin{tabular}{c} 0.00} & \multirow{3}{*}{0.00} & \multirow{3}{*}{0.00} & \multirow{3}{*}{0.00} & \multirow{3}{*}{100} & \multirow{3}{*}{0.00} \\ \cline{2-2} \cline{6-8}  & & & & & & & \\ \cline{2-2} \cline{6-8}  & & 0.00 & 0.00 & 0.00 & 0.00 & 100 & 100 & 0.00 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Confusion matrix values of the proposed HYBRID3b model. The study addresses the detection of DDoS attacks against the physical testbed using SCADA systems. For this, approaches based on deep learning and machine learning were used. The number of previous studies that detected attacks using ready-made datasets was very high. Fewer studies created a testbed for attack detection, prepared their own dataset, and performed analyses using the dataset. Both types of studies were equally included and reviewed. Machine learning-based classifier methods such as KNN, Naive Bayes, and random forest were generally used in attack detection. There were also studies based on deep learning approaches such as LSTM and neural networks.