# Detection Model for 5G Core PFCP DDoS Attacks Based on Sin-Cos-bIAVOa
## 4 Experimental Results and Analysis
### Experiment on Classification and Identification of Attack Types  
In the previous section, the comparative experimental results demonstrated that the proposed method achieves higher detection accuracy relative to traditional machine learning algorithms for binary classification applications such as attack detection, confirming its ability to effectively identify PFCP DDOS attack traffic in 5G core networks. Building on this, another experiment was designed to further validate the algorithm's recognition accuracy across different attack types.  
The experimental dataset in this subsection employs a mixed dataset in which attack packets and normal packets are balanced in a 4:1 ratio. The attack packets are evenly distributed among four types of attacks: PFCP session establishment DDoS attacks, PFCP session deletion DDoS attacks, PFCP session modification flooding (DROP) attacks, and PFCP session change flooding (DUPL) attacks. In the mixed dataset, the packet counts for the five categories are approximately evenly distributed. Each category is assigned a distinct timeout (15 s, 20 s, 60 s, 120 s, and 240 s, respectively) in order to increase the complexity of the experiment and allow for further evaluation of the the proposed algorithm's accuracy and adaptability.  
The experimental results are shown in Table 7. The accuracy for the five different timeouts ranging from 15 s to 240 s is 81.713%, 79.4907%, 84.478%, 86.445%, and 89.5522%, respectively, showing an initial slight decline followed by a gradual increase. The highest accuracy of 89.5522% is achieved with the longest timeout of 240 s. A comprehensive analysis of the various metrics indicates that with an adequate extension of the timeout period, the proposed attack detection classification algorithm demonstrates a notable performance improvement in several aspects, including feature reduction, accuracy, precision, recall, specificity, and F-value. Notably, all of these metrics reach relatively high levels when the timeout is set to 240 s.  
To comprehensively evaluate the performance of the classification algorithm, a \(5\times 5\) confusion matrix is employed in Figure 11 to visually display the distribution of the classification results. The results reveal the algorithm's recognition ability for different classes, clearly illustrating the prediction confusions for each class. The experiment conducted classification tests on five types of communication packets, with the specific labels being as follows: 1, normal data; 2, establishment DDoS attack; 3, deletion DDoS attack; 4, modification DDoS (DROP) attack; 5, modification DDoS (DUPL) attack. The classification performance of the algorithm was also evaluated under five distinct timeout conditions.  
A comparison of the confusion matrix results under different timeout conditions reveals that the timeout duration has a significant impact on the performance of the classification algorithm. The values along the main diagonals demonstrate that the overall classification accuracy varies under different timeout conditions. With extended timeout durations, a certain level of classification accuracy can be maintained. In terms of categorization, the algorithm is more accurate for the normal data, establishment DDoS attack, and deletion DDoS attack data types, while the accuracy for the modification DDoS (DROP) attack and modification DDoS (DUPL) attack data types is slightly lower.  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Timeout(s)** & **Fitness** &
\begin{tabular}{c} **Feature** \\ **Reduction Rate** \\ \end{tabular} & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **Specificity (\%)** & **F-Measure (\%)** \\ \hline
15 & 0.18319 & 0.21519 & 81.713 & 81.7937 & 81.5645 & 95.4375 & 81.6789 \\
20 & 0.20431 & 0.12658 & 79.4907 & 79.4623 & 78.833 & 94.8953