## 6 Results and Discussion
### Accuracy Evaluation  
We evaluated our machine learning models based on the confusion matrix illustrated in Figure 13. The confusion matrix utilizes the True Positive Rate (TPR) and False Negative Rate (FPR). First, TPR and FPR were calculated using Equation (1) and Equation (2), respectively. Then the accuracy was calculated using Equation (3) [42].  
\[\text{TPR}=\text{TP}/(\text{TP}+\text{FN}) \tag{1}\]  
\[\text{FPR}=\text{FP}/(\text{FP}+\text{TN}) \tag{2}\]  
\[\text{Accuracy}=(\text{TP}+\text{TN})/(\text{TP}+\text{TN}+\text{FP}+\text{ FN}) \tag{3}\]  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Hardware/Software** & **Description** \\ \hline MATLAB & Version 2022a \\ CPU & Intel® CoreTM i7-9750H CPU @ 2.60 GHz \\ Memory & 16.0 GB \\ GPU & NVIDIA GeForce RTX 2070 GDDR6 @ 8 GB \\ \hline \hline \end{tabular}
\end{table}
Table 4: Hardware and software description.  
Figure 13: Confusion matrix for calculating TPR and FPR.  
TP is the true positive, meaning that the number of normal traffic is correctly classified as normal. FN is the false negative, meaning that the number of anomaly traffic is classified as normal traffic. Likewise, FP is the false positive, meaning that the number of normal traffic is classified as anomaly traffic. Finally, TN is the false negative, meaning the anomaly traffic is correctly classified as anomaly traffic. In addition, we have evaluated our models in terms of other standard metrics, including precision, recall, F1-Score, and specificity, as represented in Table 5([PERSON] et al., 2018).  
Table 5 shows that our detection ML models achieved 100% accuracy in the four metrics (Precision, recall, F1-Score, and specificity). In addition, we accomplished between 99.12% to 99.99% for classification ML models. The reason is that the comprehensive and enhanced data engineering as we have thoroughly investigated the dataset to come up with optimal (best) features that led to almost optimal performance of (precision, recall, F1-Score, and specificity) in the case of detection ML models. We discussed the data engineering process in Section 4.2.  
\[\text{Precision }=\text{TP}/(\text{TP}+\text{FP}) \tag{4}\]  
\[\text{Recall }=\text{TP}/(\text{TP}+\text{FN}) \tag{5}\]  
\[\text{F1}-\text{Score }=2\times(\text{Precision }\times\text{ Recall})/(\text{Precision}+\text{Recall}) \tag{6}\]  
\[\text{Specificity }=\text{TN}/(\text{TN}+\text{FP}) \tag{7}\]  
The confusion matrices for the detection model (binary classification) of all ML techniques were equal for all and are shown in Figure 14a; thus, there was no need for them to be repeated.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**ML Model** & **Detection/Classification** & **Precision** & **Recall** & **F1-Score** & **Specificity** \\ \hline SSNs & Detection & 100\% & 100\% & 100\% & 100\% \\ SSNs & Classification & 100\% & 99.99\% & 99.99\% & 100\% \\ DT & Detection & 100\% & 100\% & 100\% & 100\% \\ DT & Classification & 99.99\% & 99.99\% & 99.99\% & 100\% \\ BT & Detection & 100\% & 100\% & 100\% & 100\% \\ BT & Classification & 100\% & 99.99\% & 99.99\% & 100\% \\ SVM & Detection & 100\% & 100\% & 100\% & 100\% \\ SVM & Classification & 99.78\% & 99.81\% & 99.79\% & 99.96\% \\ KNN & Detection & 100\% & 100\% & 100\% & 100\% \\ KNN & Classification & 98.88\% & 99.36\% & 99.12\% & 99.84\% \\ \hline \hline \end{tabular}
\end{table}
Table 5: Accuracy evaluation results.