## 4 Experiments
### Experimental Setup
#### 4.4.3 Experimental Setup 3: Isolation Forest  
This is a supervised algorithm used for classification and anomaly detection problems; it performs very well for a dataset with an unequal number of classes. It identifies anomalies by separating the data points using randomly selected values and using random division values between the maximum and minimum values of the function selected from a particular set of features. It works like a decision tree algorithm using rules that are generated in the training phase. It enables the separation of abnormal data points because they have shortened path characteristics. In normal situations, to detect anomalies, we create a profile of normal data points and identify those points that do not follow this profile. This is a complex and computationally costly task because of the largest path characteristic. Isolation forest does not work using \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Parameters** & **Explanations** \\ \hline Kernel & It specifies whether the method employs a linear, polynomial, radial basis function (RBF), sigmoidal, precalculated, or callable kernel as a tuning parameter. If we make no choices, “RBF” is applied. \\ \hline Degree & It indicates the degree of the utilized kernel functions of polynomials. \\ \hline Gamma & The gamma value is a kernel coefficient. \\ \hline Coef0 & Plot and sigmoid functions employ it as a self-determining term. \\ \hline Nu & It shows the upper and lowers bound values in the interval [0, 1]. It may be set to 0.5 by default. \\ \hline Shrinking & It may be used to make heuristics more compact. \\ \hline Cache-size & The amount of memory in the kernel cache, measured in megabytes, must be provided. \\ \hline Verbose & It allows for extensive production. A runtime option in the lib-preprocessing SVM’s section is used, as communicated below. \\ \hline Max- iteration & It is challenging to restrict iterations. \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Key parameters used in support vector machine. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Parameter** & **Value** & **Parameter** & **Value** \\ \hline Cache & 200 MB & Degree & 2 \\ \hline Tol & 0.001 & Verbose & False \\ \hline Coef0 & 0.0 & Max-iteration & \(-1\) \\ \hline Nu & 0.025 & Shrinking & True \\ \hline Kernel & Rbf & Gamma & Auto \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Parameter values used in support vector machine. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**F1 Score** & **Accuracy** & **ROC Cure** & **Specificity** & **Sensitivity** \\ \hline
0.64 & 0.97 & 0.97 & 0.97 & 0.97 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Support vector machine result of one-class. the principle of defining normal behavior and distance measuring between data points. As the word isolation suggests, it works by isolating the anomalies explicitly. Isolation forest operates on the premise that abnormalities should be modest and have distinguishable anomalous behavior. In isolation forests, anomalies are isolated using a collection of isolation trees as data points. For profiling anomalous data points in a collection of various data points, it employs various combinations of isolation trees. We do not need to raise the depth of the tree in a remote forest, and we may decrease the computational expense and memory demand since abnormal data points have significantly shorter tree pathways than regular data points [36]. For decision making with regard to malicious activity, the score is classified as per the data points into anomaly and non-anomaly [37]. Table 10 shows the key variables used for the isolation forest. Each observation in the data collection is given an anomaly score. The categories of anomaly scores are as follows:  
* An observation is an anomaly if the score is closest to 1. * An observation is not an abnormality if the score is much lower than 1. * An observation is a non-anomaly if the score is closest to 0.5.