# A Machine-Learning-Based Cyberattack Detector for a Cloud-Based SDN Controller
## 5 Analysis of the Attack Detector
### Performance Evaluation of the Machine-Learning Model for Cryptomining Detection  
Once trained, the model was evaluated in an offline fashion. For this purpose, a test dataset representing 20% of a reserved portion of the total dataset that was never used for model training was first selected, and then inference was run on it. The performance of the model was then evaluated by comparing the predicted results with the actual labels in the data. The metrics used to measure the model performance include the well-known metrics of the Precision, Balanced Accuracy, F1 Score and Confusion Matrix. Balanced Precision was incorporated among the evaluation metrics to account for the imbalances that exist in the dataset. A brief explanation of the metrics used and other relevant definitions is provided in the following. * **True Negative (TN)**: number of cases in which the model correctly predicted a negative outcome. The True Negative Rate (TNR) measures the rate of negative outcomes that were correctly predicted as negative. * **False Positive (FP)**: the number of cases in which the model incorrectly predicted a positive outcome. The False Positive Rate (FPR) measures the rate of negative samples that were mislabelled as positives. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**CS ID** & **SC ID** & **Name** & **Type** & **Description** \\ \hline
13 & 27 & SYN count & Numeric & Number of SYN segments observed (including rtx). \\ \hline - & 90 & window scale & - & Scaling values negotiated [scale factor] \\ \hline
70 & - & MSS & Bytes & MSS declared \\ \hline
71 & 94 & max seg size & Bytes & Maximum segment size observed \\ \hline
72 & 95 & min seg size & Bytes & Minimum segment size observed \\ \hline
73 & 96 & win max & Bytes & Maximum receiver window announced (already scaled by the window scale factor) \\ \hline
74 & 97 & win min & Bytes & Minimum receiver window announced (already scaled by the window scale factor) \\ \hline
76 & 99 & cwin max & Bytes & Maximum in-flight-size computed as the difference between the largest sequence number so far, and the corresponding last ACK message on the reverse path. It is an estimate of the congestion window \\ \hline
77 & 100 & cwin min & Bytes & Minimum in-flight-size \\ \hline
78 & - & initial cwin & Bytes & First in-flight size, or total number of unack-ed bytes sent before receiving the first ACK segment \\ \hline \hline \end{tabular} CS: Client to server traffic. SC: Server to client traffic.  
\end{table} 
Table 2: Selected features of the Crypto dataset to train the baseline model. * **False Negative (FN)**: the number of cases in which the model incorrectly predicted a negative outcome. The False Negative Rate (FNR) measures the rate of positive samples that were mislabelled as negative. * **True Positive (TP)**: the number of cases in which the model correctly predicted a positive outcome. The True Positive Rate (TPR) measures the rate of positive samples that were correctly labelled as positive. * **Accuracy**: the rate of correct predictions made by the model. It is calculated by taking the ratio of True Positives and True Negatives to the total number of predictions. The formula is given by: Accuracy = (TP + TN)/(TP + TN + FP + FN). * **Balanced Accuracy**: the Accuracy of the model in predicting both positive and negative classes. The formula is given by: Balanced Accuracy = (TP/P + TN/N)/2, where P is the total number of positive examples and N is the total number of negative examples. * **Precision**: the True Positive Rate of all positive predictions made by the model. The formula is as follows: Precision = (TP)/(TP + FP). * **Recall**: the true positive rate of all True Positive examples in the dataset. The formula is as follows: Recall = (TP)/(TP + FN). * **F1 Score**: it is calculated by taking the harmonic mean of the Precision and Recall. The formula is given by: F1 Score = 2 \(\times\) (Precision \(\times\) Recall)/(Precision + Recall).