Table 21.
Binary classification results for Normal flows vs. DDoS/DoS subcategories (protocols), using the second feature set.
| Classes | Best Model (s) | Accuracy | Precision | Recall | F1 Score |
|---|---|---|---|---|---|
| Normal vs. DDoS | Decision Tree and Random Forest | 99.956% | 99.956% | 99.956% | 99.956% |
| Normal vs. DDoS UDP | Decision Tree and Random Forest | 99.853% | 99.853% | 99.853% | 99.853% |
| Normal vs. DDoS HTTP | Decision Tree and Random Forest | 100% | 100% | 100% | 100% |
| Normal vs. DDoS TCP | Decision Tree and Random Forest | 100% | 100% | 100% | 100% |
| Normal vs. DoS | Random Forest | 99.868% | 99.868% | 99.868% | 99.868% |
| Normal vs. DoS UDP | All models, except for SVM | 100% | 100% | 100% | 100% |
| Normal vs. DoS HTTP | Decision Tree | 100% | 100% | 100% | 100% |
| Normal vs. DoS TCP | Decision Tree and Random Forest | 100% | 100% | 100% | 100% |