## 4 Results and Discussion  
Anomaly mitigation schemes must be tested to ensure their effectiveness. Evaluating a plan helps to determine its effectiveness. Therefore, it is necessary to use a structured dataset that effectively represents the environmental trace flow characteristics in which the model will be implemented, as this cannot be achieved on a real-world network. The BoT-IoT dataset provides an appropriate setting for traffic flow in a connected IoT environment, so we will use it for this purpose [26]. The dataset contains both real and simulated  
Figure 3: Modified test framework for SDN-based smart city [29]. IoT traffic, as well as threats. The dataset was created on an IoT testbed using feature extraction methods and network platforms. Virtual machines were used to generate valid and malicious traffic on the network platforms. The MQTT protocol is used to simulate smart city network traffic [29]. A temperature sensor station, humidity sensor, CO2, and smart lights are some of the scenarios simulated. Fourteen new features were derived from the thirty features to improve the predictive power of the classifiers that will be used. The BoT-IoT consists of normal traffic, probing attacks, DDoS, and information theft. The BoT-IoT contains 9543 instances of legitimate traffic flow, while it has 73,360,900 illegitimates instances. However, only 740,637 cases were randomly selected for this simulation. The theft attacks, which are negligible, are not included in the extracted occurrences. As illustrated in Figure 4, the model's performance is evaluated using the confusion matrix to quantify the accuracy of its predictions. The performance of the model can be accessed through metrics such as accuracy, detection rate, false-positive rate, false-negative rate, F1 score, etc. We will present a brief definition of these metrics. 1. Accuracy: This is the measure of all positive classifications of all instances in the dataset of an intrusion detection system that can be derived as follows: \[(Acc=TN+TP)/(TP+FP+TN+FN)\] where \(TN\) represents the total negative classified instances, \(TP\) represents the positive classified instances, \(FP\) represents false-positive classified, and \(FN\) represents false-negative classification of the data. 2. Detection Rate (DR): The true-positive rate (TPR) is the number of properly recognized malicious observations to the total number of malicious observations in the dataset, which can be derived as follows: \[DR=TP/(FN+TP)\]
3. False-Positive Rate (FPR): This is the percentage of normal observations to the total number of normal data that are incorrectly labeled as attacks: \[FPR=FP/(FP+TN)\]
4. False-Negative Rate (FNR): An attack's misclassification rate, which is also known as precision, is calculated as follows: \[FNR=FN/(FN+TP)\]
5. F1: Recall and accuracy may be weighted averaged to calculate F1 using the formula: F1 \(Score=2\times(Recall\times Precision)/(Recall+Precision)\)  
Figure 4: Performance measurement through confusion matrix. To see how well it stacks up with existing classification algorithms, k-fold cross-validation tests validate that the XGBoost classifier performs supervisor decision tree, k-nearest neighbor, naive Bayes, and gradient boosting. In the 10-fold cross-validation procedure, a random number generator divides the dataset into ten equal pieces. Only a component of the split dataset is used for each assessment, and the remaining portions of the dataset are used for training purposes. Once for each segment of the partitioned dataset, the procedure is repeated to obtain superior results. The ratio of features in the dataset and the ratio of the training instances have been balanced to avoid overfitting. It ensures low variance and bias, as well as the avoidance of overfitting. In light of the dataset's asymmetry in terms of instances of traffic flows, the classifiers are evaluated in terms of the entire classification report, rather than on individual instances.