# A Distributed Trustable Framework for AI-Aided Anomaly Detection +
## 4 Performance Evaluation
### DDoS Edge Attacks  
In this scenario, we focus on the edge part of the network, using the comprehensive network intrusion detection dataset (NIDD) [36]. 5G-NIDD presents a combination of attack traffic and normal traffic under DDoS and port scan/reconnaissance attacks. The attacker edge nodes target a 5G multi-access edge (MEC) server. Under DDoS attacks, the dataset contains ICMP Flood, UDP Flood, SYN Flood, HTTP Flood, and Slow-rate DDoS. Under port scans, the dataset contains SYN Scan, TCP Connect Scan, and UDP Scan. In total, we have 1,215,890 samples, of which 477,737 are labeled as \"normal traffic\" and 738,153 are labeled as \"attack\", resulting in a ratio of 60.7-39.3%. Here, attacks are divided into eight different types:  
* ICMP Flood (1115 samples).
* HTTP Flood (140,812 samples).
* Slow Rate DDoS (73,124 samples).
* SYN Flood (9721 samples).
* SYN Scan (20,043 samples).
* TCP Connect Scan (20,052 samples).
* UDP Flood (457,340 samples).
* UDP Scan (15,906 samples).  
Initially, dimensionality reduction was achieved through a feature selection process, as presented in Section 4.1. By quantifying the importance of each feature with the F-scores, 10 (out of 30) features with the highest ANOVA F-score were selected, as shown in Figure 6. To further address dimensionality issues, we conducted experiments with the 5, 10, 15, 20, and 25 highest-scoring features, with the experiments using 10 features exhibiting the best accuracy/training time trade-off. The 10 selected features are listed and defined below, in ascending F-score order:  
* Proto_tcp: TCP protocol is used.
* Proto_udp: UDP protocol is used.
* dHops: Estimation of the number of IP hops from the destination to this point.
* Ackdat: TCP connection setup time, the time between the SYN_ACK and the ACK packets.
* sHops: Estimation of the number of IP hops from the source to this point.
* dttl: Destination-to-source time to live (TTL) value.
* Seq: argus sequence number.  
Figure 6: ANOVA F-scores for each feature (DDoS edge attack case).  
State_RST: Indication of the principle state for the transaction report, being protocol dependent. For TCP connections, this is \"RST\", i.e., a connection is reset.
* Tcprtt: TCP connection set up round-trip time, the sum of \"synack\" and \"ackdat\".
* State_REQ: For TCP connections, this is denoted as \"REQ\", indicating that a connection is being requested.  
Again, for these 10 features, we performed Z-score normalization, using the mean and standard dataset deviation, so that data have zero mean and unit variance. Next, we conducted a 10-fold cross-validation with these 10 features as input for three ML algorithms, i.e. RF, naive Bayes, and K-nearest neighbors (K-NN). Before conducting the tests, we tuned the hyperparameters following the grid search approach to select the optimal learning parameters for each model. Regarding the number of individual trees in the RF algorithm, we considered four different cases, i.e., 20, 50, 70, and 100 trees, and the mean accuracy (across the ten folds) was computed as 0.9911, 0.9915, 0.9917, and 0.9919, respectively. Similarly, for the K-NN model, we considered four different cases for the number of neighbors (K), i.e., 3, 5, 7, and 9, and the mean accuracy was calculated as 0.9875, 0.9882, 0.9866, and 0.9869, respectively. Subsequently, to fairly compare all the ML baselines, we set both the K-NN and the RF with their optimal parameters, i.e., K-NN with five neighbors and RF with 100 individual trees. Figure 7 illustrates the classification accuracy results for RF, K-NN and Naive Bayes algorithms. It can be observed that the RF algorithm and K-NN achieve significantly higher accuracy than Naive Bayes. Notably, RF marginally outperforms K-NN since it achieves an accuracy of 0.9919 versus 0.9882. However, K-NN provides the best accuracy-complexity trade-off, as RF exhibited a much higher training and evaluation time over K-NN for the adopted hyper-parameters.