## 4 Results and Analysis
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & & \multicolumn{4}{c}{**Precision (\%)**} \\ \hline
**Algorithm** & **Subset A** & **Subset B** & **Subset C** & **Subset M** & **Average** \\ \hline Random Forest Classifier & 91.96 & 91.46 & 92.61 & 81.75 & 89.45 \\ \hline Decision Tree Classifier & 90.31 & 91.88 & 92.83 & 80.54 & 88.89 \\ \hline Simple Logistics & 91.36 & 91.45 & 90.78 & 80.35 & 88.49 \\ \hline K-Nearest Neighbors & 90.93 & 89.52 & 91.82 & 79.79 & 88.02 \\ \hline Support Vector Machine & 90.19 & 88.04 & 90.71 & 80.04 & 87.25 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Results of the precision of each subset for each tested algorithm. samples were obtained from the \"DDoS_TFTP\" service, and each sample (Sample #0 to Sample #4) includes 200,000 random records, sequential in time (i.e., if the first sample is collected from 14 to 16 h, the following is from 16 to 20 h). Sample #0 was used for the initial operation. It was trained in the trainers using the three algorithms selected, and generated three machine learning models. The accuracy and precision results for Sample #0 using the three models are presented in Table 5. The results show that the decision tree classifier was the best regarding accuracy and precision, and thus, it was selected as the model to evaluate the next sample, i.e., Sample #1, in both scenarios. In the baseline scenario, the decision tree classifier model was deployed directly in an IDS and tested with the remaining four different categorized samples to obtain their accuracy and precision. In the proposed architecture scenario, the remaining procedures are depicted in Figure 8. The three models were deployed in the classifiers, and the decision tree classifier model was loaded into the IDS. This model was tested with Sample #1 to calculate the accuracy and precision (1). Each sample was sent, unclassified, to the master (2), and the classifiers categorized each sample; these samples were classified by the majority voting system (3). The classified samples were sent to trainers (4), and each model was deployed in the classifiers, with the best deployed in the IDS (5). The process was repeated for all remaining samples, and the classifiers had the models generated by the training of the previous sample. In the execution of the tests presented above, for each sample tested in each architecture, the accuracy and precision of the model were obtained to compare the results. Table 6 presents the models used for each sample for the baseline and for the proposed architecture. In the baseline, there are no new trainings, so the model used was always the result of the training of Sample #0, that is, the decision tree classifier. In the proposed architecture, with each new training, the best model is sent to the IDS, and thus, the decision tree classifier was selected for Sample #1, the random forest classifier was selected for Sample #2, and the decision tree classifier was selected for Samples #3 and #4. \begin{table}
\begin{tabular}{c c c} \hline \hline  & **Baseline** & **Proposed Architecture** \\ \hline Sample \#1 & & Decision Tree Classifier \\ \hline Sample \#2 & & Random Forest Classifier \\ \hline Sample \#3 & & Decision Tree Classifier \\ \hline Sample \#4 & & Decision Tree Classifier \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Models used for the baseline and the proposed architecture scenarios. \begin{table}
\begin{tabular}{c c c} \hline \hline  & **Sample \#0** \\ \hline
**Algorithm** & **Accuracy (\%)** & **Precision (\%)** \\ \hline Decision Tree Classifier & 93.04 & 91.85 \\ \hline Random Forest Classifier & 92.43 & 91.07 \\ \hline Simple Logistics & 91.78 & 90.32 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Accuracy and precision for Sample #0.