## 5 Results
### eWINE Data Set
#### 5.1.1 Detection Rate of the Poisoned Samples  
This sub-section provides the results related to the metric measuring the detection performance of the poisoned samples. As described before, the metric is the ratio between the number of samples detected by the OD algorithm against the number of poisoned samples. The metric is reported as \(P_{Det}\).  
Figure 2 and the related subfigures show a comparison of the detection rate \(P_{Det}\) for the three attacks (LF, FSP, and TFP) and the three different OD algorithms for different values of \(T_{P}\). It can be noted from Figure 1(a) that SDO and IF have similar values of \(P_{Det}\) for values of \(T_{P}\) lower or equal to 0.3. Meanwhile, for the FSP and TFP attacks, in Figure 1(b),c, SDO has a much larger \(P_{Det}\) than IF and OCSVM, which justifies the focus of this paper on the SDO algorithm. The potential reason for the high performance of SDO is due to the design of this algorithm, which focuses on the identification of the low-density areas in the multi-dimensional space. The effect of the FSP and TFP attacks is to lower the density of the samples because the inserted poisoned samples are outside of the high-density region. It can be noted that for increasing values of \(T_{P}\), the OCSVM algorithm is able to increase the value of \(P_{Det}\) but this is still lower than the values of \(P_{Det}\) obtained with SDO, even if it surpasses the \(P_{Det}\) obtained by the IF algorithm. It can also be noted that \(P_{Det}\) obtained with SDO is roughly equal across the values of \(P_{Det}\), which provides a good degree of stability in the results.  
Figure 2 described above provides a view of the impact of the \(T_{P}\) parameter. It is also important to evaluate the impact of \(P_{S}\), which is shown in Figure 3 only for the SDO algorithm for reasons of space. It is noted that the results for LF are not presented here  
Figure 2: Comparison of the OD algorithms for the detection rate of poisoned samples with scenario 1 (Office 1) and \(S_{P}=16\). The y-axis provides the percentage of poisoned samples correctly identified as such by the OD algorithm. On the y-axis, the value of the percentage \(T_{P}\) of poisoned samples over the overall samples is given.  
because \(S_{P}\) does not have relevance for the LF attack. As expected, the value of \(P_{Det}\) increases for higher values of \(S_{P}\) because the perturbation is greater, which'moves' the poisoned samples to less dense areas in the feature space, where the SDO algorithm is particularly suited to detect the anomalies, which are in most cases related to the poisoned samples. Overall, it can be seen that SDO manages to reach a remarkable \(P_{Det}\) near 80% for \(S_{P}=16\). It can also be noted that the \(P_{Det}\) is slightly lower in the TFP attack for lower values of \(S_{P}\). This justifies the introduction of the novel and more challenging TFP attack in comparison to the classic FSP perturbation attack.  
Due to reasons of space, most of the results presented so far are related to the scenario 1 (Office 1) in the eWINE data set. The subsequent figure, Figure 4, shows the detection rate obtained using the SDO algorithm across the different scenarios of the eWINE data set. Regarding the detection rate, the results are generally consistent across the different scenarios, which indicates that the proposed approach has a good degree of generalization.