## 5 Results and Discussion
Although the metrics shown in Figure 10 are useful for analyzing the effect of different combinations of parameters on model performance, in practice, the same model compiled with its parameters should be used to detect anomalies in the application to any of the attacks. Thus, it is expected that the model used in a real scenario simultaneously offers acceptable performance for different attacks. For purposes of comparison with the results obtained in this experiment, the Table 5 as well as the graph in Figure 11 were generated by gathering the results obtained by [29] for each attack using only the model called SFN-opt from Figure 10 and the results obtained using the framework proposed in this work. The SFN-opt model in Figure 10 makes use of a custom function for data normalization and includes as features of dataset the number of arguments (fields) and the number of characters of the arguments (length) of system calls, just like in this experiment. Figure 10: Attack detection performance metrics obtained by [29]. \begin{table}
\begin{tabular}{|c|c|c|c|c|c|c|} \hline \multirow{2}{*}{**Attack**} & \multicolumn{3}{c|}{**NPV**} & \multicolumn{3}{c|}{**ACC**} & \multicolumn{3}{c|}{**COV**} \\ \cline{2-7}  & **SFN-opt** & **This Work** & **SFN-opt** & **This Work** & **SFN-opt** & **This Work** \\ \hline Brute Force Login & 67.85\% & **78.34\%** & 92.09\% & 84.18\% & 81.95\% & **99.53\%** \\ Remote Shell & 49.37\% & **77.79\%** & 82.49\% & **88.94\%** & 99.36\% & 99.31\% \\ Meterpreter & 10.01\% & **85.55\%** & 95.39\% & 91.44\% & 18.62\% & **99.70\%** \\ Malicious Script & 67.62\% & **69.89\%** & 79.95\% & **86.74\%** & 48.41\% & **99.32\%** \\ Docker Escape & 81.87\% & 78.10\% & 75.91\% & **95.48\%** & 75.67\% & **99.50\%** \\ SQL Injection & 7.00\% & **76.56\%** & 0.93\% & **76.60\%** & 0\% & **99.00\%** \\ SQL Misbehavior & N/A & **60.12\%** & N/A & **64.64\%** & N/A & **99.77\%** \\ \hline \end{tabular}
\end{table} 
Table 5: Comparison table of the performance metrics of Figure 10 SFN-opt model and the results obtained in this work. In Table 5, the values obtained by this work that surpassed the performance of the study carried out by [29] using the model SFN-opt were highlighted in bold, which corresponds to 80.95% of all metrics collected. To summarize the results obtained in this experiment, the Table 6 contains the metrics obtained for all attacks with the confidence interval (CI) set to 99%, which is equivalent to a loss threshold equal to 0.0164. In addition to NPV, ACC and COV values, other metrics such as Precision, TPR, FPR, F1-Score shown respectively in Equations (4)-(7), as well as the ROC-AUC metric were calculated for better comparison of results with possible future work. * Precision (Pre): Ratio of items correctly predicted to be of a class over the total of items predicted to be of this class (correctly or not). \[Pre=\frac{TP}{TP+FP}\] (4)
* True Positive Rate (TPR), Recall (Rec) or Sensitivity: Rate of items correctly predicted to be of a class over all items belonging to that class class. \[TPR=\frac{TP}{TP+FN}\] (5)
* False Positive Rate (FPR) or False Alert Rate (FAR): Rate of items incorrectly predicted to be of a class over all items not of that class. \[FPR=\frac{FP}{TN+FP}\] (6)
* F1 Score or F-Score: Harmonic mean between Precision (Pre) and True Positive Rate (TPR). \[F1 Score=2*\frac{Pre*TPR}{Pre+TPR}\] (7)  
Figure 11: Comparison graph of the performance metrics of Figure 10 SFN-opt model and the results obtained in this work. According to [29], the experiment carried out in their study failed to detect SQL Injection and SQL Misbehavior attacks. However, the model trained in this work achieved significantly better results for these attacks. For instance, the Coverage metric (COV) had values equal to or greater than 99%, indicating the model's ability to correctly classify a system call window as negative (benign). This indicates the negative rating model (TNR) capability of a system call window.