# Anomaly Detection for IOT Systems Using Active Learning
## 5 Results
### Confusion Matrix  
A confusion matrix simplifies the machine learning system evaluation. Model performance is measured by correct predictions, including true positives, true negatives, false positives, and false negatives. True positive (TP) models effectively anticipate the positive class. A true negative (TN) occurs when the model properly predicts the negative class. A model FP happens when it mis-predicts the positive class. A false negative (FN) occurs when the model mis-predicts the negative class.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Evaluation Metric** & **Performance Value** \\ \hline Weighted Average Accuracy & 0.995 \\ Accuracy Precision & 0.997 \\ Recall & 0.974 \\ F1-Score & 0.992 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Evaluation metrics of the proposed model.  
Figure 12 below illustrates that 11,062 samples from the test data were accurately predicted within the harmful class, whereas 57 samples were incorrectly classified as belonging to the normal class. In the normal class, a total of 13,580 instances were accurately predicted, with only one instance being incorrectly predicted. The discrepancy in incorrect predictions between the two classes can be attributed to a slight imbalance within the dataset, wherein the number of normal samples exceeded that of malicious samples.  
In assessing the effectiveness of an anomaly detection model through active learning, it is essential to monitor the number of labeled instances employed for training during each iteration alongside the progression of the performance metrics. Cross-validation techniques are additionally recommended to offer a more precise assessment of the model's performance. When analyzing the mistakes generated by a model, it is crucial to consider many factors that may contribute to misclassification, including data imbalance, noise in the data, and model complexity.  
The suggested model's evaluation metrics are summarized in Table 6, which is an important part of evaluating the model's performance. These metrics provide insightful information about the model's effectiveness in several areas. With a high value of 0.995, the weighted average accuracy shows that the model is generally accurate in its predictions, even when the classes are unbalanced. The accuracy demonstrates that nearly 99.7% of the dataset's cases are properly predicted by the model. It is an easy way to gauge overall accuracy. Another crucial statistic is precision, which now stands at 0.974. The proportion of accurate positive predictions made by the model is indicated by precision. This indicates that roughly 97.4% of the model's optimistic predictions were correct. Recall is 0.971, which indicates that 97.1% of all real positive cases are captured by the model. The F1-score is currently 0.992. This measurement strikes a compromise between recall and precision. It shows that the model is achieving excellent results in balancing the reduction of false positives and false negatives. The performance of the suggested model, which is shown in the table, is encouraging. It exhibits high classification accuracy, strong classification precision, high recall, and high F1-score values, all of which indicate that the model is successful in properly classifying events in the dataset.  
Figure 12: Confusion matrix of testing data.  
The receiver operating characteristic (ROC) curve illustrates the performance of prediction accuracy, as shown in Figure 13. A curve that approaches a value of 1 implies a strong version of the model. Conversely, a curve centered at 0.5 suggests that the model's accuracy is approximately 50%. In our specific example, the curve is positioned at 1.0, indicating exceptional model performance with an accuracy close to 100%.