## 4 Result Discussion and Performance Evaluation  
The extracted real-time 68,722 pressure values which is an essential process variable from the SCADA system were plotted against the date and time. Pressure is a critical process variable in this process as over-pressurization could lead to explosion and under-pressurization could lead to the implosion of the process vessel, either with catastrophic results which will impact adversely the people, assets, and the environment. The features of \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Algorithm** & **Accuracy (\%)** & **Training Time (ms)** & **MCE** & **Prediction Speed (obs/s)** \\ \hline
**Decision Trees** & & & & \\ Fine Tree (FT) & 100 & 1.1708 & 0 & 1,200,000 \\ Medium Tree (MT) & 100 & 1.0781 & 0 & 1,300,000 \\ Coarse Tree (CT) & 100 & 0.45488 & 0 & 1,000,000 \\ Optimizable Tree & 100 & 21.323 & 0 & 1,300,000 \\ \hline
**Discriminant Analysis** & & & & \\ Linear & & & & \\ Discriminant & 100 & 1.843 & 24 & 1,100,000 \\ (LDR) & & & & \\ Quadratic & & & & \\ Discriminant & 99.2 & 1.1597 & 518 & 1,600,000 \\ (QDR) & & & & \\ \hline Optimizable Discriminant & 100 & 25.029 & 24 & 1,600,000 \\
**Logistic Regression (LR)** & 100 & 3.205 & N/A & 1,100,000 \\ \hline
**Naive Bayes** & & & & \\ Gaussian Naive & 99.2 & 1.4947 & 518 & 1,400,000 \\ Bayes (GNB) & & & & \\ Kernel Naive Bayes & 100 & 65.633 & 8 & 4500 \\ (KNB) & 100 & 918.96 & 8 & 3800 \\ \hline
**Support Vector Machines (SVM)** & & & & \\ Linear SVM & 100 & 7.3065 & 25 & 780,000 \\ Quadratic SVM & 100 & 383.79 & 17 & 1,500,000 \\ Cubic SVM & 80.2 & 1657.3 & 13,588 & 930,000 \\ Fine Gaussian SVM & 100 & 7.433 & 5 & 610,000 \\ Medium Gaussian & & & & \\ SVM & 100 & 5.3155 & 1 & 760,000 \\ Coarse Gaussian & 100 & 5.1452 & 20 & 1,100,000 \\ SVM & 100 & 7490.9 & 25 & 1,100,000 \\ \hline
**Nearest Neighbors** & & & & \\ Fine KNN & 100 & 3.6447 & 0 & 820,000 \\ Medium KNN & 100 & 2.0989 & 5 & 460,000 \\ Coarse KNN & 99.9 & 3.5228 & 35 & 130,000 \\ Cosine KNN & 99.9 & 17.422 & 35 & 17,000 \\ Cubic KNN & 100 & 2.3157 & 5 & 380,000 \\ Weighted KNN & 100 & 2.1524 & 0 & 450,000 \\ \hline
**Ensemble Learning (EL)** & & & & \\ Boosted Trees & 99.9 & 5.0025 & 35 & 1,200,000 \\ Bagged Tree & 100 & 8.5874 & 0 & 320,000 \\ Subspace & 100 & 4.5421 & 24 & 260,000 \\ Discriminant & & & & \\ Subspace KNN & 100 & 12.777 & 0 & 93,000 \\ RUS-Boosted Tree & 100 & 2.4396 & 20 & 960,000 \\ Optimized & 100 & 232.87 & 0 & 530,000 \\ Ensemble & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Behavior of SCADA pressure dataset using different machine learning algorithms. the extracted real-time data plotted in Figure 5a show that the data do not contain extremely high or extremely low values of pressure for the period under review. For the purpose of simulating the man-in-the-middle (MitM) attack, extreme values of pressure were injected into the dataset on specific dates and times. Figure 5b shows the plot of SCADA pressure against the date and time with the anomalies injected. In Figure 6a, with the contamination parameter set to 0.1, the isolation forest algorithm showed high sensitivity in detecting changes in the pressure values for the period under review including the extreme high-pressure values, and detected all as anomalies. This can be termed high False Alarm Rates (FAR). With the contamination parameter set to 0.01, the Isolation Forest was able to detect as anomalies the extreme low-pressure values only with reduced FAR, but it was unable to identify the extremely high anomalies in the dataset and this makes this algorithm for real-time detecting MitM attacks as shown in Figure 6b. In Figure 7a, with step set to 34361, batch size of 32 and 20 epochs, the long short-term memory (LSTM) algorithm detected some of the extreme pressure values for the period under review. Changing the batch size to 128 as in Figure 7b, the algorithm detected all the extreme high-pressure values as anomalies though with FAR.