# Detection Model for 5G Core PFCP DDoS Attacks Based on Sin-Cos-bIAVOa
## 4 Experimental Results and Analysis
### Accuracy Comparison Evaluation Experiment  
This section aims to evaluate the detection performance of various algorithms in terms of their DDoS attack detection by comparing their effectiveness under different timeout values. The goal is to determine the adaptability of different algorithms in detecting attacks within various time windows (timeout values), thereby providing theoretical support and practical guidance for DDoS attack detection in real applications. The experimental dataset utilizes a mixed dataset in which attack packets and normal packets are proportionally balanced at a ratio of 1:1. To increase the complexity of the experiment and further assess the accuracy and adaptability of the algorithms, the attack packets are evenly distributed among four types of attacks: PFCP session establishment DDoS attack, PFCP session deletion DDoS attack, PFCP session modification flood attack (DROP apply action field flag), and PFCP session modification flood attack (DUPL apply action field flag). The experiment introduces eight commonly used attack detection algorithms for comparison: Back-Propagation (BP), Convolutional Neural Network (CNN), Radial Basis Function \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Timeout (s)** & **Fitness** &
\begin{tabular}{c} **Feature** \\ **Reduction Rate** \\ \end{tabular} & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **Specificity (\%)** & **F-Measure (\%)** \\ \hline
15 & 0.000795 & 0.025316 & 99.9452 & 100 & 99.9155 & 100 & 99.9577 \\
20 & 0.002002 & 0.075949 & 99.8745 & 99.8917 & 99.8917 & 99.8507 & 99.8917 \\
60 & 0.002100 & 0.025316 & 99.8134 & 100 & 99.6732 & 100 & 99.8363 \\
120 & 0.000253 & 0.025316 & 100 & 100 & 100 & 100 \\
240 & 0.000253 & 0.025316 & 100 & 100 & 100 & 100 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Results on PFCP session modification DDoS attack DROP dataset. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Timeout (s)** & **Fitness** &
\begin{tabular}{c} **Feature** \\ **Reduction Rate** \\ \end{tabular} & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **Specificity (\%)** & **F-Measure (\%)** \\ \hline
15 & 0.001232 & 0.050633 & 98.9166 & 98.4646 & 100 & 96.4506 & 99.2264 \\
20 & 0.010144 & 0.037975 & 99.0137 & 98.547 & 99.9133 & 97.4665 & 99.2255 \\
60 & 0.011539 & 0.037975 & 98.8728 & 98.25 & 100 & 96.9298 & 99.1173 \\
120 & 0.009363 & 0.025316 & 99.0798 & 98.5294 & 100 & 97.6 & 99.2593 \\
240 & 0.004965 & 0.050633 & 99.5495 & 99.359 & 100 & 98.5075 & 99.6785 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Results on PFCP session deletion DDoS attack dataset. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Timeout (s)** & **Fitness** & \begin{tabular}{c} **Feature** \\ **Reduction Rate** \\ \end{tabular}  & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **Specificity (\%)** & **F-Measure (\%)** \\ \hline
15 & 0.001448 & 0.10127 & 99.9559 & 99.9393 & 100 & 99.8397 & 99.9696 \\
20 & 0.000253 & 0.025316 & 100 & 100 & 100 & 100 & 100 \\
60 & 0.000253 & 0.025316 & 100 & 100 & 100 & 100 & 100 \\
120 & 0.000253 & 0.025316 & 100 & 100(RBF), Extreme Learning Machine (ELM), Random Forest (RF), Support Vector Machine (SVM), Long Short-Term Memory (LSTM), and AVOA. The experiment also established five different timeout values (15 s, 20 s, 60 s, 120 s, and 240 s) to simulate the detection performance under different time windows. The selection of timeout values aims to cover detection scenarios from short time windows to long time windows. The experimental results are shown in Table 6, with detection accuracy as the main performance metric used to evaluate the effectiveness of each algorithm under different timeout values. Figure 10 provides a visual comparison of the detection accuracy results for various algorithms under different timeout values. The Sin-Cos-bIAVOA algorithm consistently exhibits the highest detection accuracy across all timeout values, with an average accuracy of 0.97948.