Review Reports

Round 1

Reviewer 1 Report

Abstract: needs to refine. authors should mention what will be the takeaway from the paper. The feedforward neural network, decision tree, support 20 vector machine, k-nearest neighbor, and weighted k-nearest neighbor models were evaluated using 21-nine numerical features from the Kyoto 2006+ dataset: Authors should also justify why they selected the above algorithms whether they are appropriate to apply to the Kyoto data set. the introduction should be presented in small paragraphs. there is no organization of the paper. authors should include in the introduction section. Related work should be presented in a clear and concise manner. authors should highlight the pros and cons of each existing method and then brief the required research gap.  The proposed work should be represented in a step-by-step manner or with a flow diagram. give the specification of the Kyoto data set.  Results and discussion authors should compare the results of the proposed method with the existing method . the conclusion should support with data and future direction is missing 

 

 

 

 

 

 

Author Response

Dear Reviewer,

thank you very much for your observation, comments, suggestions, directions and overall guidance on our paper improvement. 

We have attached the file with a response to your comments.

Best regards

 

Danijela Protic

corresponding author

Author Response File: Author Response.pdf

Reviewer 2 Report

The idea of this paper is interesting. However, I have the following concerns.

Authors considered use of nine numerical features from the Kyoto 2006+ dataset to evaluate ML algorithms, due to that:

·       The authors should enumerate selected numerical feature and describe their relevance in comparison with dismissed categorical values.

·       The authors should add and discuss the possibility that proposed approach dismissing statistical features (at all 24 – 9 = 15 features dismissed) did not make selected nine features to produce ML model, which gives such high accuracy results.

On the other hand, the authors should consider and discuss results based on differences in ACC (%) and F1 score (%) evaluations from that perspective:

·       When using accuracy on imbalanced problems, it is simple to obtain a high accuracy score by categorizing all observations as belonging to the majority class.

·       Most of the time, the F1 score is more useful than accuracy, especially when the class distribution is skewed.

Lines 299-300 the author’s states: “It is demonstrated that the wk-NN model has the highest classification accuracy and the best F1-score. Table 2 displays the results.” But in Table 2 better result for F1 score 99.33% is given for FNN model (Min-Max[0,1]) in comparison for wk-NN model (Min-Max[-1,1]) 99.29%.

Author Response

Dear Reviewer,

thank you very much for your observation, comments, suggestions, directions and overall guidance on our paper improvement. 

We have attached the file with a response to your comments.

Best regards

 

Danijela Protic

corresponding author

Author Response File: Author Response.pdf

Reviewer 3 Report

 

1.     Introduction should be divided into paragraphs, same for the related works.

2.     Table 1 should be presented in other way, such as list all the references with the corresponding method, classifier, feature selection, etc.

3.     How the data availability not applicable! Since the authors used Kyoto 2006+ dataset.

4.     The author should evaluate their approach on newer dataset, the Kyoto 2006+ dataset is out of date.

5.     The reason mentioned for choosing the Kyoto 2006+ is not logical. All the mentioned datasets can be used for anomaly detection, all you have to do is to exclude the attacks traffic from the training data. (Keep only normal traffic)

6.     Equations must be referred to in the text

7.     The most important metrics in anomaly detection evaluation are true positive rate and false alarms, which both have not been used by the authors.

8.     The structure of the paper must be reorganized, and the proposed approach section must be extended to contain all relevant details.

 

Author Response

Dear Reviewer,

thank you very much for your observation, comments, suggestions, directions and overall guidance on our paper improvement. 

We have attached the file with a response to your comments.

Best regards

 

Danijela Protic

corresponding author

Author Response File: Author Response.pdf

Round 2

Reviewer 2 Report

Authors have improved the article “Cybersecurity in smart cities: Detection of opposing decisions on anomalies in the computer network behavior”.

Reviewer 3 Report

I think the authors addressed all the provided comments.