## 6 Validation
### Evaluation of Decision Trees  
The test for the different types of decision trees was carried out by using different types of attribute selection measures and different features split approaches. To develop the different tests, the architecture used was based on an instance in Google Cloud. Considering the size of the dataset, the needed memory for the instance to develop its activity must be enough to include the dataset itself and the model to train with it. For this reason, the initially chosen machine contained 100 GB of RAM memory and an eight-core processor. Four different combinations were tested. Three parameters were measured: the time needed to carry out the training, the precision, and the error, all of which are detailed in Table 6.  
When the random splitting criteria are applied, the time needed to make the calculations is heavily reduced, since it does not calculate which one is better, choosing one random feature to continue the tree. This is penalized by reducing the accuracy and lightly elevating the error rate, which is, however, almost negligible. More important than accuracy and times for training are the threat detection rates, since the IDS is expected to detect as many security problems as possible. Given the available attacks that were present in the preprocessed dataset and summarized in Table 4, confusion matrices were obtained for each of the cases. The first important conclusion from the results is that the random splitting strategy is not a valid solution. An IDS cannot have such a high false negative rate, detecting 72.33% of the cases as \"no attack\" when it really was an attack in the worst case. This rate was lowered to 6.33% of the false negative rate in the entropy/best combination, which can be classified as acceptable, since, with an IDS, it is preferable to have a higher rate of false positives rather than false negatives. In each case, the decision tree was generated so that the criteria followed by the algorithm could be checked. Thanks to this, it was possible to verify that the main criteria that the decision tree took were the origin and destination IP addresses. These IP addresses, coded as an index, were only an anonymized number since this was done in the dataset itself. It is logical to think that data such as the port of origin and destination, the duration of the flow, or the amount of data transmitted are more important. For this reason, it was decided to repeat the test, this time removing the trace of IP addresses from the dataset. In this repetition, the best results balancing quality and time were again achieved with the \"entropy\" calculation and \"best\" splitting strategy. The time needed to execute this algorithm was 2786.77 seconds. The accuracy achieved was 0.99614035. Logically, the amount of time needed decreased, while the distribution of accuracy and error remained the same. The confusion matrix for this case is presented in Table 7. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline  & & \multicolumn{6}{c}{**Quality of Split**} \\ \cline{3-8}  & & \multicolumn{3}{c}{**“Gini”**} & \multicolumn{3}{c}{**“Entropy”**} \\ \cline{2-8}  & & **Time** & **Accuracy** & **Error** & **Time** & **Accuracy** & **Error** \\ \hline
**Splitter** & **Best** & 2899.448 & 0.999 & 0.0012 & 3423.31 & 0.999 & 0.0011 \\
**strategy** & **Random** & 497.19 & 0.989 & 0.0120 & 448.976 & 0.988 & 0.0119 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Summary of the result achieved using different combinations of algorithms for decision trees using the fully preprocessed dataset. In this case, the false negative rate increased slightly, with a 24% rate. However, looking at the decision tree, it is more logical to think that this algorithm is more prepared to predict attacks in more situations since it is not using IP addresses. Furthermore, analyzing how the model is predicting attacks, several conclusions can be drawn. Firstly, the model presents good results in the classification of network denial of service attacks, with a success rate of 99.97%.