## 3 Materials and Method
### Experimental Design
#### 3.4.3 Performance Metrics  
In this research, a comprehensive evaluation of the model's performance in detecting cyberattack behaviors was conducted by selecting and applying a series of key performance metrics, including Precision, Recall, and Accuracy. These metrics assess the model's performance from different dimensions, reflecting not only the accuracy of the model in detecting attack behaviors but also its ability to recognize true attack actions. Precision, also known as positive predictive value, is an important metric measuring the accuracy of the model's predictions. It indicates the proportion of samples correctly identified as attack behaviors out of all samples identified as such by the model. The formula for Precision is as follows:\[\text{Precision}=\frac{TP}{TP+FP} \tag{19}\]  
where \(TP\) (True Positives) denotes the number of true positive cases, i.e., the samples correctly identified as attack behaviors by the model, while \(FP\) (False Positives) denotes the number of false positive cases, i.e., the samples incorrectly identified as attack behaviors. The higher the Precision, the more accurate the model is in identifying attack behaviors, with fewer false positives. Recall, also known as sensitivity, is another crucial metric measuring the model's coverage. It represents the proportion of true attack behavior samples correctly identified by the model out of all actual attack behavior samples. The formula for Recall is as follows:  
\[\text{Recall}=\frac{TP}{TP+FN} \tag{20}\]  
where \(FN\) (False Negatives) represents the number of false negative cases, i.e., the samples incorrectly identified as normal behavior by the model. The higher the Recall, the more complete the model is in identifying all attack behaviors, with fewer omissions. Accuracy is the most intuitive performance metric, representing the proportion of samples correctly identified by the model (including both attack and normal behaviors) out of the total samples. The formula for Accuracy is as follows:  
\[\text{Accuracy}=\frac{TP+TN}{TP+TN+FP+FN} \tag{21}\]  
where \(TN\) (True Negatives) represents the number of true negative cases, i.e., the samples correctly identified as normal behavior. The higher the Accuracy, the stronger the model's overall identification ability. These evaluation metrics are significant for assessing model performance. Precision and Recall evaluate the model's ability to recognize attack behaviors from different perspectives, one focusing on prediction accuracy and the other on prediction completeness. In practical applications, depending on the requirements of different scenarios, more emphasis may be placed on one of these metrics. For instance, in scenarios highly sensitive to false positives, Precision may be prioritized, while in scenarios where missing any attack behavior is critical, Recall may be emphasized. Accuracy, as a comprehensive metric, intuitively reflects the model's performance across all samples and is crucial for assessing the model's overall performance. However, when dealing with imbalanced datasets, where there is a significant difference in the number of attack behavior samples compared to normal behavior samples, relying solely on Accuracy may be misleading. In such cases, even if the model classifies all samples as the more numerous class, it may still achieve high Accuracy; however, this does not indicate good recognition ability. Therefore, when evaluating model performance, rather than depending solely on Accuracy, other metrics such as Precision and Recall should be considered as well. To find a balance between Precision and Recall, the F1 Score was introduced as a performance evaluation metric. The F1 Score is the harmonic mean of Precision and Recall, considering both the accuracy and completeness of the model, and is calculated as follows:  
\[\text{F1 Score}=2\times\frac{\text{Precision}\times\text{Recall}}{\text{ Precision}+\text{Recall}} \tag{22}\]  
The higher the F1 Score, the better the balance between Precision and Recall, indicating better overall performance.