## 5 Results and Discussion
Once the model was trained and the error thresholds were determined, the machine learning module operated in detection mode, where it read each attack index from Elasticsearch and executed the remaining processing steps, following the Algorithm 2 presented above. The code executed in the Jupyter Notebook format for detecting anomalies in the performed attacks is also available in the GitHub repository [36]. As a result of the anomaly detection performed for each attack, an index was created in Elasticsearch to store the detection information and the obtained results. Figure 9 showcases a Kibana dashboard designed to visualize the indexed data, specifically the anomalies detected during the Brute Force attack. This dashboard allows for interactive analysis of the results through its graphical interface. The components of the dashboard depicted in Figure 9 include: the total number of analyzed system call windows, a pie chart displaying the percentage of anomalous and normal windows, the confidence interval and loss threshold used, a graph illustrating the error obtained in each system call window by timestamp  
Figure 7: Benign hashes data structure details. in comparison to the defined loss threshold, a distribution histogram of anomalous and normal windows by timestamp, and a table providing detailed information about each analyzed system call window. In binary classification problems (normal or anomaly class) normally, primary results of algorithm evaluation are used and other metrics can then be obtained based on these results. These results can be represented through a confusion matrix, demonstrating the prediction capacity of the algorithm's classes, according to Table 4.  
Figure 8: Model definition obtained by using the Hyperopt library. \begin{table}
\begin{tabular}{c c} \hline \hline
**Confidence Interval** & **Loss Threshold** \\ \hline
1 & 0.2456 \\
0.995 & 0.0251 \\
0.99 & 0.0164 \\
0.98 & 0.0110 \\
0.97 & 0.0091 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Loss threshold for each confidence interval. From the results of the confusion matrix of Table 4, the following metrics can be derived [17,47]:  
* Negative Predicted Value (NPV): Ratio of items correctly predicted as not being of a class over total items predicted as not being of this class (correctly or not). \[NPV=\frac{TN}{TN+FN}\] (1)
* Accuracy (Acc): Success rate in the classification of all results of the confusion matrix. \[Acc=\frac{TP+TN}{TP+TN+FP+FN}\] (2)
* True Negative Rate (TNR), Coverage (COV), or Specificity: Rate of items correctly predicted to not be of a class over all items not belonging to that class class. \[TNR=\frac{TN}{TN+FP}\] (3)  
For performance analysis in attack detection, the following evaluation metrics were adopted by [29] in their work:  
* NPV--according to Equation (1)
* ACC (Accuracy)--according to Equation (2)
* COV (Coverage)--according to Equation (3) \begin{table}
\begin{tabular}{c c c c} \hline \hline  & & \multicolumn{3}{c}{Predicted Value} \\ \cline{3-4}  & & False & True \\ \hline \multirow{2}{*}{Real Value} & False & True Negative (\(TN\)) & False Positive (\(FP\)) \\ \cline{2-4}  & True & False Negative (\(FN\)) & True Positive (\(TP\)) \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Confusion matrix with classification results of an algorithm. Figure 9: Dashboard for viewing anomalies detected during the Brute Force attack. In total, forty-two models were tested in the experiment conducted by [29], which involved different combinations of window sizes for system calls, sets of features, data normalization methods, and confidence intervals. Figure 10 showcases the results obtained by [29] for six out of the seven attacks present in the dataset. The figure also presents the results for six models that utilized different data normalization functions and sets of features from the dataset.