## 4 Evaluation  
### Evaluation Metrics  
For all the mentioned algorithms, a binary classifier will produce a confusion matrix that depicts the number of correctly and incorrectly classified positive and negative samples--True Positives (TP), True Negatives (TN), False Positives (FP) and False Negatives (FN). In this section, the metrics widely used in evaluating the performance of machine learning models will be presented, all calculated from the four values in the confusion matrix.  
The first metric is _Accuracy (A)_. This metric evaluated the models' classification, as it is the fraction of predictions that the model predicted correctly. It is calculated by dividing the number of correct predictions by the total number of predictions, expressed as a percentage (Equation (3a)). When considered in isolation, _Accuracy_ can be misleading if classes are not represented equally in the dataset, i.e., in case of a class imbalance. For a dataset containing 95% malicious samples and 5% non-malicious, a model that predicted'malicious' 100% of the time would achieve 95% accuracy.  
The _Precision (P)_ ratio quantifies the true positives in relation to the total of true positives and false positives (Equation (3b)) and describes the proportion of correct positive classifications. Where a class imbalance exists, the precision can be calculated for each class to indicate whether the imbalance affects the model's ability to classify correctly. Since a false negative result is a misclassified positive, this metric expresses the proportion of the examples classified as positive as a proportion of the overall number of actual positives.  
The _True Positive Rate_ (Equation (3c)) is also referred to as Recall and Sensitivity. Since a false negative result is a misclassified positive, this metric expresses the proportion of examples that were classified as positive as a proportion of the overall number of actual positives.  
The _False Positive Rate (FPR)_ is the proportion of all negatives that still yield positive test outcomes, or the misclassified negatives. The FPR is the number of false positives (i.e., misclassified negatives) divided by the total number of negatives (Equation (3e)). This is the likelihood that a positive will be predicted for an actually negative example.  
The _True Negative Rate (TNR)_ is also referred to as specificity. As already noted, false positives are misclassified negatives. The true negative rate is the number of true negatives divided by the total number of actual negative values (Equation (3f)). It measures how accurate the model is at making negative predictions.  
The opposite of the TNR, the _False Negative Rate (FNR)_, represents misclassified positives. It measures the number of misclassified positives as a proportion of the total number of positives (Equation (3g)). The \(F1\) score, a machine learning metric, was also used in the classification process of the models by calculating the weighted average of Precision and Recall. Recall describes the proportion of true positive predictions to actual positives, and precision represents the proportion of true positive predictions to the total of true positives and false positives (Equation (3d)). The \(F1\) score combines these two values, producing a harmonic mean of TPR and precision. The \(F1\) score takes a value between 0 and 1, and a value of 1, indicating no false positives and no false negatives, is optimal.  
\[Accuracy\ A=\frac{TP+TN}{TP+FP+TN+FN} \tag{3a}\] \[Precision\ P\ =\frac{TP}{TP+FP}\] (3b) \[True\ Positive\ Rate\ P\ =\frac{TP}{TP+FN}\] (3c) \[F1\ Score\ f\ =\frac{2 TP}{2 TP+FP+FN}\] (3d) \[False\ Positive\ Rate\ FPR=\frac{FP}{FP+TN}\] (3e) \[True\ Negative\ Rate(Specificity)\ TNR=\frac{TN}{TN+FP}\] (3f) \[False\ Negative\ Rate\ FNR=\frac{FN}{FN+TP} \tag{3g}\]  
Equations (3a-g): Evaluation Metrics, (a) Accuracy, (b) Precision, (c) True Positive Rate, (d) \(F1\) Score, (e) False Positive Rate, (f) True Negative Rate, (g) False Negative Rate.