# Evaluating Ensemble Learning Mechanisms for Predicting Advanced Cyber Attacks
## 5 Evaluation and Discussion  
### Evaluation Results  
In order to assess and compare the performance of the constructed models, various evaluation metrics such as accuracy rate, false positive rate, and true negative rate need to be calculated. These metrics are derived from a confusion matrix, which presents a tabular representation of predicted and actual classes [36]. Instead of an image, Table 5 below illustrates the structure of the confusion matrix, such that:  
* True Positives (TP): Represent the instances where the classifier correctly predicts positive classes. * True Negatives (TN): Indicate the instances where the classifier correctly predicts negative classes. * False Positives (FP): Refer to the instances where the classifier incorrectly predicts positive classes. * False Negatives (FN): Represent the instances where the classifier incorrectly predicts negative classes. To assess the performance of the models, several key metrics can be calculated based on the terms. These metrics provide valuable insights into the accuracy and reliability of the models. The following calculations can be applied:  
* Accuracy (TPR):  
Accuracy, also known as the true positive rate, measures the overall correctness of the predictions. It is computed using the following formula:  
\[\text{TPR}\;=(\text{TP}\;+\;\text{TN})\;/\;(\text{TP}\;+\;\text{TN}\;+\;\text{ FP}\;+\;\text{FN}) \tag{3}\]  
The accuracy metric takes into account both the true positives and true negatives and provides an overall assessment of the model's performance. \begin{table}
\begin{tabular}{l l l} \hline \hline
**First Feature** & **Correlation** & **log_Correlation** \\ \hline dur & \(0.0019274028701131475\) & \(-0.03254413756460623\) \\ syytes & \(0.010344749695229565\) & \(-0.35616315558984374\) \\ dyytes & \(-0.07641408324436148\) & \(-0.5193868283741477\) \\ sload & \(0.192119481000086756\) & \(0.347460145034949\) \\ dload & \(-0.21978094930126515\) & \(-0.0603535881626365\) \\ spkts & \(-0.12200425437154418\) & \(-0.3163533826967563\) \\ stcpb & \(-0.23365153315010911\) & \(-0.3135563222142905\) \\ dtcpb & \(-0.23346071773809843\) & \(-0.3134006479812102\) \\ smeansz & \(-0.06517990378993671\) & \(-0.15111450989648337\) \\ dmeansz & \(-0.27230605607442226\) & \(-0.564640212740172\) \\ res\_bdy\_len & \(-0.0268968526601601\) & \(-0.06794901821505799\) \\ \hline \hline \end{tabular}
\end{table} 
Table 4: _log_ transformation of some data features. \begin{table}
\begin{tabular}{c c c} \hline \hline  & **Predicted Positive** & **Predicted Negative** \\ \hline Actual Positive & True Positives (TP) & False Negatives (FN) \\ \hline Actual Negative & False Positives (FP) & True Negatives (TN) \\ \hline \hline \end{tabular}
\end{table} 
Table 5: The structure of the confusion matrix. Precision (P): Precision refers to the percentage of positive predictions that are correct. It is determined by the following formula:  
\[\text{P }=\text{ TP / (TP +\text{ FP})} \tag{4}\]  
Precision focuses on the correctness of positive predictions and provides insights into the model's ability to accurately identify positive instances. * Recall (R): Recall, also known as sensitivity or true positive rate, measures the proportion of positive instances that are correctly identified by the model. It is calculated as follows:  
\[\text{R}=\text{TP/(TP +\text{ FN})} \tag{5}\]  
Recall is crucial in scenarios where detecting all positive instances is of utmost importance. It helps evaluate the model's ability to capture positive instances. * F1-score: The F1-score is a weighted average of precision and recall, providing a balanced measure of the model's performance. It can be computed using the following formula:  
\[\text{F1-score}=2\times\text{(Precision }\times\text{Recall)/(Precision + Recall)} \tag{6}\]  
The F1-score combines precision and recall, giving equal importance to both metrics. It is particularly useful when there is an imbalance between positive and negative instances in the dataset.