# Integration of Machine Learning-Based Attack Detectors into Defensive Exercises of a 5G Cyber Range
## 9 Exercises
### DoH Flooding Attack Detection Scenario
#### 9.2.3 Application and Integration of Machine Learning for DoH Flooding Attack Detection
More sophisticated methods of model poisoning that are more difficult to detect or do not require privilege escalation could also be applied at the cost of increased complexity, but they are beyond the scope of our exercise, as we only intend to provide a potential vulnerability that could be effectively exploited to compromise the model and its results to teach the blue team to be aware of this \begin{table}
\begin{tabular}{c c c} \hline \hline
**Model Name** & **Structure** & **Max. Epochs** & **Batch Size** \\ \hline \multirow{2}{*}{\
\begin{tabular}{c} doh\_dl\_a.pkl \\ (Good performance) \\ \end{tabular} } & FC Layers: [62; 31; 15; 3] & \multirow{4}{*}{100} & \multirow{2}{*}{2048} \\  & Activation: ReLU & & \\ \cline{1-1}  & Final Activation: SoftMax & & \\ \hline \multirow{2}{*}{
\begin{tabular}{c} doh\_dl\_b.pkl \\ (Medium performance) \\ \end{tabular} } & FC Layers: [62] & \multirow{2}{*}{1} & \multirow{2}{*}{2048} \\  & Activation: ReLU & & & \\ \cline{1-1}  & Final Activation: SoftMax & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Hyperparameters for each DoH Deep Learning model generated. \begin{table}
\begin{tabular}{c c c|c|c} \hline \hline
**Model Name** & **Quality Measure** & \multicolumn{2}{c}{**Score**} \\ \hline \multirow{4}{*}{\begin{tabular}{c} doh\_rf\_31\_a.pkl \\ (Good performance) \\ \end{tabular} } & F1-Score & \multicolumn{2}{c}{0.940} \\  & Balanced Accuracy & \multicolumn{2}{c}{0.935} \\  & Confusion & **0** & **1** & **2** \\ \cline{3-5}  & Matrix & **0** & 199,645 & 2174 & 790 \\ \cline{3-5}  & **1** & 6977 & 116,008 & 12,343 \\ \cline{3-5}  & **2** & 6257 & 246 & 169,298 \\ \hline \multirow{4}{*}{\begin{tabular}{c} doh\_rf\_31\_b.pkl \\ (Medium performance) \\ \end{tabular} } & F1-Score & \multicolumn{2}{c}{0.620} \\  & Balanced Accuracy & \multicolumn{2}{c}{0.654} \\  & Confusion & **0** & **1** & **2** \\ \cline{3-5}  & Matrix & **0** & 193,883 & 0 & 8726 \\ \cline{3-5}  & **1** & 34,377 & 24,348 & 76,603 \\ \cline{3-5}  & **2** & 30,824 & 0 & 144,977 \\ \hline \multirow{4}{*}{\begin{tabular}{c} doh\_rf\_31\_c.pkl \\ (Bad performance) \\ \end{tabular} } & F1-Score & \multicolumn{2}{c}{0.189} \\  & Balanced Accuracy & \multicolumn{2}{c}{0.333} \\  & Confusion & **0** & **1** & **2** \\ \cline{3-5}  & Matrix & **0** & 202,609 & 0 & 0 \\ \cline{3-5}  & **1** & 135,328 & 0 & 0 \\ \cline{3-5}  & **2** & 175,801 & 0 & 0 \\ \hline \multirow{4}{*}{\
\begin{tabular}{c} doh\_dl\_31\_a.pkl \\ (Good performance) \\ \end{tabular} } & F1-Score & \multicolumn{2}{c}{0.750} \\  & Balanced Accuracy & \multicolumn{2}{c}{0.750} \\  & Balanced Accuracy & \multicolumn{2}{c}{0.750} \\  & **1** & 0** & **1** & **2** \\ \cline{3-5}  & Balanced Accuracy & \multicolumn{2}{c}{0.750} \\  & **1** & 0** & 0.750} \\ \cline{3-5}  & Matrix & **0** & 0.750} \\ \cline{3-5}  & Matrix & **0** & **1** & **2** \\ \cline{3-5}  & **2** & 0** & **1** & **2** \\ \cline{3-5}  & **2** & 0** & **1** & **2** \\ \hline \multirow{4}{*}{
\begin{tabular}{c} doh\_dl\_31\_b.pkl \\ (Medium performance) \\ \end{tabular} } & F1-Score & \multicolumn{2}{c}{0.665} \\  & Balanced Accuracy & \multicolumn{2}{c}{0.702} \\  & Confusion & **0** & **1** & **2** \\ \cline{3-5}  & Matrix & **0** & 194,700 & 1643 & 6266 \\ \cline{3-5}  & **1** & 8525 & 24,447 & 102,356 \\ \cline{3-5}  & **2** & 6166 & 27 & 169,608 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Quality measures of DoH traffic classification models. In the confusion matrices 0: NORMAL, 1: DOH, 2: DDOS DOH, where rows represent true values and columns predicted values. type of attack vector when working with ML models. By including models with different ML technologies to classify traffic, we show the blue team that the field is diverse and several different methods, with varying degrees of performance and efficiency, may be applied according to the particular needs of the organization.