## 5 Validation and Data Analysis with ML
### First Scenario: Experimentation without BCT  
We experimented with ML classifiers in order to enforce the proposed architecture by detecting attacks as a provided functionality by the upper advanced service layer without considering BCT in the first scenario. The performance metrics that were used are: accuracy, precision, sensitivity and MCC performed under a WEKA data-mining environment. WEKA is an open source environment used by researchers worldwide to manipulate various kinds of ML algorithms such as classification, regression and clustering. In this work, WEKA 3.8 under Windows 64 bits is used to perform the experiments. The TON_IoT dataset is used for attack detection in the context of IIoT. It is composed of 35975 instances, 127 attributes and considers attacks such as DoS, DDoS, injection, MitM, brute force, XSS and scanning attacks [40], as presented in Table 5. In this experiment, the employed dataset is generated by a testbed based on a virtual machine to represent the IoT networks and a KALI offensive system to represent hacker attacks. To gather the packet traveling inside the network to identify whether it is a normal activity or an attack, the Netsniff-ng and Zeek (Bro) tools are used. The experiment results have been carried out on a hardware characterized by a processor Intel Core i7 2.8 GHz and a 16 Go RAM. The choice of the TON-IoT dataset is motived by grouping two mains features such as representing an IoT network by containing packet information traffic and gathering the most common attacks targeting manufacturing environment by simulating a hacker attacker with a KALI offensive system. The TON_IoT dataset attributes are grouped into six categories such as processor information, process information, packet information, memory information, logical disk information and type and label for attack detection attributes:  
* The attributes related to processor information include Processor_pct_User Time, Processor_pct_Processor_Time, Processor_pct_Privileged_Time and so on. * The process information attributes cover Process_IOead_Operations_sec, Process_IO_WriteOperations_sec, Process_IO_Write_Bytes_sec and so on. * The packet information attributes involve Network_I(IntelR_82574L_GNC)Packets ReceivedUnknown, Network_I(IntelR_82574L_GNC, Packets Outbound Errors, Network_I(IntelR_82574L_GNC), PacketsSentUnicastsec and so on. * Memory information attributes are (but are not limited to) MemoryAvailable Bytes, Memory Cache Bytes and MemoryPage Faultssec. * Logical disk information attributes contain LogicalDisk(_Total)pct_DiskReadTime, LogicalDisk(_Total)DiskWriessec and LogicalDisk(_Total)CurrentDiskQueue Length,  
In our approach, a supervised ML based on attribute type and label to classify the various attacks was defined, according to Table 5.  
During the experimentation, the training and testing phases while using a training set were performed. To illustrate the whole life cycle performed to carry out the predictive ML metrics, Table 6 highlights the time to build a model (in second) and the time to test a model on the training data (in second) for the various classifiers to classify the different attacks in an IIoT network. On the one hand, as provided in Table 6, the ANN classifier requires the highest time for the training phase to build the ML model. However, NB takes less time to build the model. On the other hand, DT classifier presents the minimum time to test the model and NB presents the maximum testing time. Figure 6 represents the partition of the normal activity and attacks among DoS, DDoS, injection, MitM, brute force, XSS and scanning attacks during training and testing phases. To assess the performance of the model, metrics have to be defined without considering the data provided by the BC structure in this scenario. Indeed, the evaluation of the performance of a model informs us about the effectiveness of the predictions of a dataset by the trained model. For that purpose, a confusion matrix of a binary classification assessment is used.