## 4 Traffic Analysis Methods
### Metrics for Machine Learning Model Evaluation  
In order to evaluate machine learning models, it is necessary to use evaluation metrics [37; 42]. These metrics numerically express the model's ability to perform defined activities, such as classification. The most basic case is binary classification, where a mapping of an input to just two outputs (0 or 1) is performed. If 1 is marked as a positive outcome (for example, a classified attack), four situations can occur: \begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Methods** & **Type** & **Description** & **Advantages** & **Disadvantages** \\ \hline \multirow{2}{*}{K-mean} & \multirow{2}{*}{Unsupervised} & Identify unlabeled data & Simple implementation & Sensitivity to outliers \\  & & in different clusters & & \\ \hline \multirow{2}{*}{K-NN} & \multirow{2}{*}{Supervised} & Determine the distance & Simple and suitable & \\  & & between features & for classification & High computational cost \\ \hline \multirow{2}{*}{NB} & \multirow{2}{*}{Supervised} & Bays Network Theorem; & \multirow{2}{*}{High accuracy} & Required attributes are \\  & & Complex classification & & independent of each other \\ \hline \multirow{2}{*}{SVM} & \multirow{2}{*}{Supervised} & Hyperplane separation & Can solve nonlinear and & \\  & & for binary classification & high-dimensional problems & High memory cost \\ \hline DT & Supervised & Classify the target variable & Fast classification & Ease of overfit \\ \hline \multirow{2}{*}{RF} & \multirow{2}{*}{Supervised} & Algorithm composed & Fast training phase; & Unsuitable for low-dimensional \\  & & of many decision trees & Not easy to overfit & and small datasets \\ \hline \multirow{2}{*}{LR} & \multirow{2}{*}{Supervised} & \multirow{2}{*}{General linear regression} & Fast training phase; & \\  & & & Not easy to overfit & Easy to overfit \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Comparison of ML methods for protocol recognition. * True Positive (TP)--(1 = 1)--the input is an attack, and the output of the model is classified as an attack,
* True Negative (TN)--(0 = 0)--the input is regular traffic, and the model output is classified as regular traffic,
* False Positive (FP)--(0 \(\
eq\) 1)--the input is regular traffic, and the output of the model is classified as an attack,
* False Negative (FN)--(1 \(\
eq\) 0)--the input is an attack, and the output of the model is classified as regular traffic. These metrics are further used to calculate other auxiliary evaluation metrics [42]. Visualizations of the underlying metrics can be made in the form of a Confusion Matrix, which is used to provide a basic representation of the ratio of each group. Additional metrics are then typically calculated based on this matrix. Accuracy is a metric that defines the comprehensive success rate of the model and is defined as the ratio of TP and TN to the total number of classified entries; see Equation (1). This metric can be described as a definition of how good a model is and its recognition capabilities. Precision is a metric that is defined as the ratio of TP to the sum of TP and FP; see Equation (2). This metric is described as the accuracy of the model, i.e., whether the recognition capabilities are correct and whether it produces coherent results. Recall is a metric also referred to as True Positive Rate or Sensitivity and is the ratio of TP to the sum of TP and FN; see Equation (3). It is an indicator of the completeness of the model's detection of positive cases. Precision focuses on the accuracy of positive predictions, while Recall evaluates the ability of the model to detect as many true positive cases (TP) as possible. The F1 score metric provides a composite view of how accurate the model is, not only in its accuracy but also in its ability to identify TPs using the Precision and Recall metrics, see Equation (4). This metric aids model assessment, especially in cases where the dataset is unbalanced and where separate Precision and Recall values could be misleading.