## 4 Experiments and Results
### Evaluation
\begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Model** & **Accuracy** & **Macro Avg Precision** & **Macro Avg Recall** & **Macro Avg F1-Score** \\ \hline \multicolumn{5}{c}{Using Machine Learning Models} \\ \hline Decision Tree & 0.93 & 0.69 & 0.70 & 0.70 \\ \hline Random Forest & 0.93 & 0.73 & 0.69 & 0.70 \\ \hline XGBoost & 0.94 & 0.71 & 0.69 & 0.69 \\ \hline Gradient Boosting & 0.93 & 0.71 & 0.65 & 0.67 \\ \hline KNN & 0.85 & 0.60 & 0.44 & 0.46 \\ \hline \multicolumn{5}{c}{Using Federated Learning Models} \\ \hline Decision Tree & 0.92 & 0.68 & 0.67 & 0.67 \\ \hline Random Forest & 0.92 & 0.69 & 0.68 & 0.68 \\ \hline XGBoost & 0.93 & 0.68 & 0.67 & 0.67 \\ \hline Gradient Boosting & 0.92 & 0.66 & 0.67 & 0.66 \\ \hline KNN & 0.88 & 0.68 & 0.67 & 0.67 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison of classification performance using 25 selected features with machine learning and federated learning. The confusion matrices for each model offer valuable insights into their classification performances by showcasing the counts of true positives, false positives, true negatives, and false negatives, as shown in Figure 7. The confusion matrix for the Decision Tree model Figure 7a shows that while the model accurately classifies some instances, there are also notable misclassifications, particularly between certain classes. This pattern highlights the Decision Tree's tendency to overfit, which can lead to unreliable predictions of new data. In Figure 7b, the confusion matrix for the Random Forest model indicates a significant improvement in classification accuracy, with a higher number of true positives and fewer misclassifications due to its ensemble approach. Figure 7c presents the confusion matrix for the XGBoost model, which excels in classification, as evidenced by a high count of true positives and a decrease in false positives and false negatives. This shows that XGBoost effectively captures the underlying data patterns, leading to more accurate predictions. The confusion matrix for the Gradient Boosting model Figure 7d achieves high accuracy with many true positives. However, it shows slightly more confusion among some classes, indicating potential areas for improvement. Lastly, Figure 7e illustrates the confusion matrix for the K-Nearest Neighbors (KNN) model. While KNN performs reasonably, the matrix reveals a higher rate of misclassifications, particularly in distinguishing closely related classes, which can lead to less reliable predictions in complex datasets. The confusion matrices reveal that ensemble methods, particularly XGBoost and Random Forest, consistently outperform simpler models like Decision Tree and KNN. This emphasizes the effectiveness of ensemble learning techniques in enhancing classification performance for complex datasets. Table 7 compares the different machine learning models used for DDoS attack detection with a focus on various parameters. The models in consideration, Decision Tree, Random Forest, XGBoost, Gradient Boosting, and K-Neighbor (KNN), were assessed about their elapsed time and the volume of resources extended, as well as the level of successful implementation of the task in three configurations: all features, 25 features, and Federated Learning (FL) 25 features. Finally, the running time and memory consumption of the FL framework on a per-client round basis are also provided in the table for comparison. From the findings, the Decision Tree model can be appreciated the most as the quickest of all, accomplishing the task in a mere 1.05 s with the retention of all the features and looking even better when the features are reduced to 25 because it consumes only 50% of the available memory. However, it slightly slows down in FL (2.75 s), but this remains an excellent performance. Random Forest shows consistent performance and is reliable even as regards the rate at which it uses the memory, but it gets a lot more efficient as the features are reduced. In FL, its memory usage goes up slightly, but its overall performance does not change.