# Unsupervised Machine Learning Techniques for Detecting PLC Process Control Anomalies
## 5 Results and Discussions
### Performance Evaluation  
This work presents a new way of visualizing anomaly detection algorithm results using a histogram. Although histograms have been used in previous work to present detection algorithms results [53; 54; 55; 56], the approach presented in this work is new and provides a better understanding of detection algorithms performance by revealing the exact proportions of true positives, true negatives, false positives, and false negatives of detection algorithms.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Parameter** & **Description** & **Value** \\ \hline \(n_{estimators}\) & Number of base estimators in the forest ensemble & 156 \\ \(n_{max}\) & Number of training samples to draw to train each estimator & 180 \\ \(f_{max}\) & Number of features to draw to train each estimator & 10 \\ contamination & Proportion of outliers in the data set & 0.05 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Model hyperparameters for IF.  
Visualization of results is done by first separating the decision scores (real numbers) into positive and negative scores represented by \(P_{1}\) and \(N_{1}\) respectively. Next, decision scores are separated into true positives, true negatives, false positives, and false negatives with associated notations \(x_{tp}\), \(x_{tn}\), \(x_{fp}\), and \(x_{fn}\), respectively, based on the ground truth of the test sets. Different algorithms provide different decision scores based on their objective functions, so the resulting \(x_{tp}\) and \(x_{fp}\) scores are normalized to a range between 0 and 1 using the maximum and minimum values in \(P_{1}\). In contrast, \(x_{tn}\) and \(x_{fn}\) scores are normalized to range between 0 and 1 using the maximum and minimum values in \(N_{1}\). Furthermore, to ensure an objective comparison of the different algorithms, the \(x_{tp}\) and \(x_{fn}\) quantities are normalized as a function of the total ground truth positives. Similarly, \(x_{tn}\) and \(x_{fp}\) are normalized as a function of the ground truth negatives. Let the normalized scores of \(x_{tp}\), \(x_{tn}\), \(x_{fp}\), and \(x_{fn}\) be \(X_{tp}\), \(X_{tn}\), \(X_{fp}\), and \(X_{fn}\) respectively. Finally, the normalized scores are used to plot a histogram of the distribution and proportion of decision scores.  
Visualization of anomaly detection results requires methods different from previous work [33], where only positive \(P_{1}\) and negative \(N_{1}\) scores are presented. The approach in Figure 6 reveals the fractions of \(P_{1}\), which corresponds to \(X_{tp}\) and \(X_{fp}\), and the fractions of \(N_{1}\) which are \(X_{tn}\) and \(X_{fn}\). Moreover, the work in [33] only shows the proportions of \(P_{1}\) and \(N_{1}\) as a function of test data size on the histogram's y-axis, which makes it challenging to visualize the \(N_{1}\) scores, primarily because test sets in anomaly detection mainly have smaller negative class proportions [45]. On the contrary, the proposed approach normalizes the histogram frequency (y-axis) to a range of 0 to 100% to present a better relative decision scores visualization. The visualization described here normalizes the \(x\) and \(y\) axes for easier comparison of different detection algorithms' performance. Finally, the proposed visualization approach may be applied to supervised ML algorithms for binary classification.