## 4 Results and Discussion
### RQ4: What Performance Metrics Are Used in DL-Based Web Attacks Detection Literature? The objective of this research question is to present and discuss the performance metrics that are commonly used to evaluate DL-based web attacks detection models. Using DL models for web attacks detection amounts to developing a classification model that can identify whether a web application is vulnerable or not (i.e., binary classification), or whether it is vulnerable to a specific web attack (e.g., vulnerable or not to XSS attacks), or determine to which web attack it is vulnerable (multi-classification problem). Different performance metrics have been used in the literature to evaluate DL-based web attacks detection models. However, we detail below the most widely used metrics as reported in Figure 11.  
Figure 10: Histogram of frameworks and platforms used in selected PS. * Accuracy: measures the ratio of the number of samples classified correctly over the total number of samples. Accuracy is not useful when the classes are unbalanced (i.e., there are a significantly larger number of examples from one class than from another). However, it does provide valuable insight when the classes are balanced. Usually, it is recommended to use recall and precision along with accuracy. \[\text{Accuracy}=\frac{\text{TP}+\text{TN}}{\text{TP}+\text{TN}+\text{FP}+\text{ FN}}\] (1)
* Recall or Sensitivity or True Positive Rate or Detection Rate: measures the proportion of actual positives that are correctly identified.The higher value of sensitivity would mean a higher value of true positive and lower value of false negative. The lower value of sensitivity would mean lower value of true positive and higher value of false negatives. \[\text{Recall}=\frac{\text{TP}}{\text{TP}+\text{FN}}\] (2)
* Precision: measures the number of positive class predictions that actually belong to the positive class. Precision does not quantify how many real positive examples were predicted as belonging to the negative class, that is why it is advisable to compute the True Negative Rate (TNR) metric. \[\text{Precision}=\frac{\text{TP}}{\text{TP}+\text{FP}}\] (3)
* F1-score: weighted harmonic mean of precision (P) and recall (R) measures. It is recommended to use F1-score rather than accuracy if we need to seek a balance between precision and recall and there is an uneven class distribution: \[\text{F1-score}=\frac{1}{\alpha.\frac{1}{P}+(1-\alpha).\frac{1}{R}}\] (4)  
Figure 11: Histogram of performance metrics used in selected PS. \(\alpha\) is chosen such that recall is considered \(\alpha\) times as important as precision. If \(\alpha\) is \(\frac{1}{2}\), then precision and recall are given equal importance. The choice of \(\alpha\), and thus the trade-off between precision and recall, depends on the classification problem. * False Positive Rate: the ratio of all benign samples incorrectly classified as malicious. It is used to plot the ROC curve: \[\text{FPR}=\frac{\text{FP}}{\text{FP}+\text{TN}}\] (5) In intrusion detection systems, it is important to have a low FPR. Otherwise, the detection system is considered not reliable. * Area Under the Curve (AUC): measures two-dimensional area under the ROC curve, ranging from 0 to 1, indicating a model's ability to distinguish between classes. Models should have a high value of AUC, so-called models with good skill. The ROC (Receiver Operating Characteristic) curve is the plot between the TPR (y-axis) and the FPR (x-axis). * True Negative Rate or Specificity: measures the proportion of actual negatives correctly identified. The higher value of specificity would mean a higher value of true negative and lower false positive rate. The lower value of specificity would mean a lower value of true negative and higher value of false positive.