# Poisoning Attacks against Communication and Computing Task Classification and Detection Techniques
## 7 Simulation Results
### Results
This section discusses the numerical results obtained after the attacks were successfully launched. We set the rate of success of exploratory attacks to 0.7. This means that in 70% of the attacker's attempts, the poisoning examples were located in the decision regions, while the rest (30%) were randomly located in the 3D plane. Visualizations of both types of attacks are shown in Figure 7.  
The number of injected poisons was equal to the average population between all the clusters. Both attacks showed dramatic degradation in ML performance. The serving time increased by 278 and 241 seconds after introducing _attack1_ and _attack2_, respectively (Figure 8). In addition, for attack2, only four servers were active, which means the other servers were being overloaded, and this demonstrated the increase in processing time with the grouped poisoning examples. Furthermore, for both attacks, we observed a higher number of tasks that were not accepted in terms of evaluation constraints. The results refer to 479 and 551 tasks not accepted for _attack1_ and _attack2_, respectively. To launch anomaly detection as a mitigation technique, a history was created as a training (reference) dataset, since the method involves semi-supervised learning. The history consisted of all the possible 5G services defined by ETSI in \"(2022-05)1683 GPP TS 23.501 version 17.4.0\" release 17. All the services were created and modeled in the  
Figure 8: Attacks’ effects. Figure 7: Attack 3D representations. same way as the chosen ones in the previous step. Once the history was created, _method1_ was launched on _attack1_. The obtained results are shown in Figure 9. The decision about anomalies was made based on the percentile of the log-likelihood score of the _GMM_. The score that maximized the precision (true positives over true positives and false positives combined) was \(-14.52\) with a percentile of 9. The choice of precision was justified as follows. Since the main objective was to detect anomalies without losing legitimate requests, the minimization of false positives (FP), also called false alarms, was critical, and hence our maximizing the precision. Anomaly detection using _GMM_ brought about a quite powerful mitigation solution. The unaccepted tasks based on the evaluation constraints dropped to near the optimal value (no attack scenario) compared with the _attack1_ scenario. However, the drawback is that the solution forced the ML to enable four servers with higher computational capabilities. This means more power was consumed, and the processing time was rather low compared with the optimal solution. In addition, only 31 requests were detected as false positives (FP), also called false alarms, and as a result these requests were lost. This method was devoted only to _attack1_, since the _attack2_ examples appeared to be legitimate under the method's constraints and could not be detected. The recall score (the ratio of true positives to true positives and false negatives combined) dropped when using _method1_ as a mitigation solution for _attack2_. The choice this time was the recall because the main goal was to not miss the malicious cluster examples (false negatives (FNs)) when the cluster was distinguished well from the others. To gain insight into this, multiple simulations were run for different numbers of injected poisons, and the recall test results were obtained (see Figure 9(a)). Since the anomaly detection had a history of all the 5G services, the attacker may have matched a centroid where a 5G service was originally located nearby, and as a result,  
Figure 10: _Method 2_ limitations. Table 2.0 _Method 1_ results. the technique mistakenly detected these examples. For this, the _silhouette score_ test was introduced to omit one of the clusters obtained by the _GMM_. But the history now is different. Since the aim was to detect and omit the whole malicious cluster, only the centroids of the groups were present in the history. To complete this, as mentioned before, Q-Q plots were used in case the clusters intersected.