Table 20.
Binary classification results for Normal flows vs. DDoS/DoS subcategories (protocols), using the first feature set.
| Classes | Best Model (s) | Accuracy | Precision | Recall | F1 Score |
|---|---|---|---|---|---|
| Normal vs. DDoS | Random Forest | 99.956% | 99.956% | 99.956% | 99.956% |
| Normal vs. DDoS UDP | Decision Tree and Random Forest | 99.853% | 99.853% | 99.853% | 99.853% |
| Normal vs. DDoS HTTP | Decision Tree and Random Forest | 100% | 100% | 100% | 100% |
| Normal vs. DDoS TCP | Decision Tree and Random Forest | 100% | 100% | 100% | 100% |
| Normal vs. DoS | Random Forest | 99.956% | 99.956% | 99.956% | 99.956% |
| Normal vs. DoS UDP | All models, except for SVM | 100% | 100% | 100% | 100% |
| Normal vs. DoS HTTP | Decision Tree | 100% | 100% | 100% | 100% |
| Normal vs. DoS TCP | All models, except for SVM | 100% | 100% | 100% | 100% |