## 5 Performance Evaluation
### Preliminary  
(1) Methods in Evaluation: To fully understand the performance of G-TIAG, we leverage four typical methods for comparison, which are briefly described as follows. All the methods are fine-tuned to achieve their best classification performance to gain a fair comparison result. * Random Forest (RF), is an algorithm that integrates multiple decision trees through integration learning, where each decision tree is a classifier. It uses the 9-dimensional features mentioned in Section 3.2 as baseline features to classify benign data and five types of attack data. * Support Vector Machine (SVM), which is a generalized linear classifier that performs binary classification with a decision boundary that is the maximum margin hyperplane solved for the learned samples. It also classifies benign data and five types of attack data using the 9-dimensional features. * Convolutional Neural Networks (CNN), which is a feedforward network including convolutional computation, has a deep structure with good representational learning capability. In addition, it can classify the input in a translation-invariant manner according to its network hierarchy. It also classifies benign data and five types of attack data using the 9-dimensional features obtained in Section 3.2.3. * Graph Convolution Network (GCN), which learns the graph's structural information and node attributes while considering the correlation between nodes, enabling a more effective and comprehensive characterization of the nodes and the nodes connected to them [25]. The GCN uses the TIAG constructed in Section 3.2 to classify the data. (2) Validation: We conducted 10 tests for each method, randomly dividing the original dataset into separate training and testing sets in the ratio of 6:4, and the average of the 10 classification results was the result. All experiments are conducted on a server with Intel(R) Core (TM) i7-8650U @ 1.90 GHz CPU and GTX1060 GPU, and the programming environment is Python 3.7, PyTorch1.10, and anaconda3-5.2.0. (3) Evaluation Indicators: Since this experiment is faced with a multi-classification problem, it is necessary to select both indicators describing the classification performance of each class of samples and indicators describing the global classification performance. We use precision, recall, and F1-score for each class of samples. We use accuracy for global samples and average the results of each class to obtain the average precision, average recall, and average F1 score. In addition, we introduce a processing rate indicator to evaluate the time cost of the classifier. * Precision, which is used to describe the proportion of samples predicted to be class A that are class A, where \(TP_{a}\) denotes the number of samples that are class A and predicted to be class A, and \(FP_{a}\) denotes the number of samples that are not class A but predicted to be class A. The specific formula is as follows. \[Pre_{a}=\frac{TP_{a}}{TP_{a}+FP_{a}}\] (15)
* Recall, which is used to describe the proportion of samples predicted to be class A that are truly class A, where \(TP_{a}\) denotes the number of samples that are class A and predicted to be class A, and FN\({}_{a}\) denotes the number of samples that are class A but predicted not to be class A. The specific formula is as follows. \[Recall_{a}=\frac{TP_{a}}{\text{TP}_{a}+\text{FN}_{a}}\] (16)
* F1-score, which is the geometric mean of precision and recall, where \(Pre_{a}\) denotes the precision of class A samples, and \(Recall_{a}\) denotes the recall of class A samples. The specific formula is as follows. \[F1-Score=\frac{2\ \times\ Pre_{a}\ \times\ Recall_{a}}{Pre_{a}+Recall_{a}}\] (17)
* Accuracy, which is used to describe the proportion of samples with correct predictions for all categories in the total samples, where \(y_{i}\) denotes whether the prediction of the ith sample is correct and if it is correct, then \(y_{i}=1\), otherwise \(y_{i}=0\).