**7. Evaluation results**

Compared to the original system, our model constructs an equivalent system with a minimal number of constraints over real-valued variables consisting of bounds on variations. This helps in reducing the high state space and improving the classification accuracy and time complexity as well.


#### **Table 3.**

*Experiment results summary I.*

**Figure 3.** *Roc curves of models performance.*

#### **7.1 Classification accuracy**

The above results show that our proposed model obtains satisfactory results with regard to attack detection rate. The proposed model has 98.9% accuracy and 97.9% precision. **Table 3** reviews the results of the performance of our model compared to the neural network (NN), Naive Bayes (NB), and HHMM classification algorithms.

We perform the tests using different window sizes to understand their influence on the detection. It shows that increasing the size of the window results in better accuracy.

**Figure 3** shows the ROC curves for the performance of our proposed model, compared to the HHMM, NN, and NB models. ROC curves help identify the balance between the true-positive rate and the false-positive rate for all possible thresholds. It illustrates the model's strength to differentiate between attack and non-attack classes (see **Figure 4**).

#### **7.2 Efficiency**

Computation time is not associated instantly with classification; however, it describes the training time taken by the model. **Table 4** shows that our model has a lower computation time compared to the HHMM. In [28], The time complexity of calculating the probability of a sequence and estimating the HHMM parameters as the model depends on the length of the observation equals *O ST*<sup>3</sup> , where S is the number of states, and, T is the granted transactions number at each level. Meanwhile, the PHHMM time complexity equals *O S*ð Þ log ð Þ*S* based on our calculations. **Figure 5** shows the time complexity of HHMM vs. PHHMM.


**Table 4.** *Comparison of computation time.*

**Figure 5.** *Time complexity of HHMM vs. PHHMM algorithms.*
