## 4 Results and Discussion
### Security Analysis Using an Adversarial Attack Model
#### 4.2.2 Attack Generation and Preprocessing of Generated Attack Data  
In this section, we will present some code snippets used to generate the attacks and preprocess the attack data to ensure consistency in modeling and a good fit with the dataset in terms of normalization, scaling, selected features, labeling, and handling missing data. Code Listing 1 simulates a DoS/DDoS attack by generating high-volume traffic to overwhelm the system:  
Code Listing 2 simulates a brute force attack by generating repeated failed login attempts. Code Listing 3 simulates a port scanning attack by generating scanning behavior data by sending packets to multiple ports. Code Listing 4 simulates a malware attack by generating malicious payload delivery and execution data. Before testing the model, we preprocessed the generated attack data by performing the following:  
* Ensure that the simulated adversarial data have the same features as the original dataset. Also, add new features related to new attacks when retraining the model to deal with data changes. * Apply the same preprocessing steps to the simulated adversarial data as those applied to the original dataset. * Ensure that the labels in the simulated adversarial data match the encoding used in the original dataset. * Ensure that the simulated adversarial data follow the same statistical distribution as the original dataset. A significant change in data distribution requires retraining the model. ```
#SimulateDoS/DDoSattack defsimulate_dos_attack(data,num_requests=1000):dos_data=data.copy()for_inrange(num_requests):dos_data=dos_data.append({'arcip':np.random.choice(dos_data['source_ip'].unique()),'dstip':np.random.choice(dos_data['destination_ip'].unique()),'protocol':np.random.choice(['TCP','UD']),'packet_size':np.random.randinit(1000,1500),'timestamp':pd.timestamp.now()},ignore_index=True) returndos_data
#Generateadversarialdata dos_data=simulate_dos_attack(data)
```  
Listing 1: DoS/DDoS simulatck  
```
defsimulate_brute_force(data,num_attempts=100):attack_data=data.copy() for_inrange(num_attempts):#Randomlyselectabuserandsimulatagailedlogin user=np.random.choice(attack_data['username'].unique()) attack_data=attack_data.append({'username':user,'login.status':'failed','srcip':np.random.choice(attack_data['source_ip'].unique()),'timestamp':pd.Timestamp.now()},ignore_index=True) returnattack_data
#Generateadversarialdata brute_force_data=simulate_brute_force(data)
```
#Simulateportscanningattack defsimulate_port_scan(data,num_scans=100): scan_data=data.copy() for_inrange(num_scans): scan_data=scan_data.append({'srcip':np.random.choice(scan_data['source_ip'].unique()), 'dstip':np.random.choice(scan_data['destination_ip'].unique()), 'destination_port':np.random.randint(1,66535), 'protocol':np.random.choice(['TCP','UDp']), 'timestamp':pd.Timestamp.now() },ignore_index=True) returnscan_data #Generateadversarialdata port_scan_data =simulate_port_scan(data)
```
Listing 4: Malware simulated attack. ```
#Simulatemalwareattack defsimulate_malware(data,num_infections=50): malware_data=data.copy() for_inrange(num_infections): malware_data=malware_data.append({'srcip':np.random.choice(malware_data['source_ip'].unique()), 'dstip':np.random.choice(malware_data['destination_ip'].unique()), 'file_size':np.random.matini(100000,10000000),#Simulatelargefilesize 'file_type':np.random.choice(['ex','4 ill','bat']), 'timestamp':pd.Timestamp.now() },ignore_index=True) returnmalware_data #Generateadversarialdata malware_data =simulate_malware(data)
```

Listing 5: Malware simulated attack. #### 4.2.3 Adversarial Model Results and Analysis

The XGBoost model was used to detect adversarial attacks because it is highly accurate and takes less time (faster model). We used two different testing methods. The first involved testing the model based on the original dataset without retraining it by using the newly generated attack data to analyze the model's robustness. Table 9 depicts the different metrics.