## 3 Methodology
### Rlfoula Framework Description
#### 3.2.3 Employing Functional Agents in RL
The algorithm combinations are ranked in order of their performance, with the top-performing combinations listed in the table. Table 2 presents the classification results of the RLFOUA framework using the four algorithms along with their respective sampling techniques. The metrics included in the table are precision, recall, F1 score, support, frequency, and accuracy. In conclusion, the application of the RLFOUA framework on the NSL-KDD dataset demonstrates its generalizability to different types of datasets. The results demonstrate that the RLFOUA framework, by autonomously identifying the top-performing algorithm combinations, effectively detects various attack types with high precision, recall, and F1 scores. Among the evaluated algorithms, the Extra Trees Classifier stands out as the most promising choice for detecting attacks within the NSL-KDD dataset. These findings contribute valuable insights for selecting suitable algorithms and sampling techniques when applying the RLFOUA framework in real-world intrusion detection scenarios. The remarkable effectiveness of certain algorithm combinations on the NSL-KDD dataset can be attributed to their adaptability to the dataset's diverse range of attack types. The Extra Trees Classifier, for instance, demonstrated exceptional performance, likely due to its inherent ability to handle complex decision boundaries and high-dimensional feature spaces. Additionally, the integration of Random Oversampling and Neighborhood Cleaning Rule Undersampling further enhanced the model's ability to discern subtle patterns within the data, contributing to higher precision and recall scores. This combination of algorithms and resampling techniques effectively leveraged the dataset's unique characteristics, allowing the RLFOUA framework to autonomously identify and employ the most suitable strategies for detecting various attack types. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Algorithm** & **Attack Type** & **Precision** & **Recall** & **F1 Score** & **Support** & **Frequency** & **Accuracy** \\ \hline \multirow{3}{*}{Decision Tree Classifier Random Oversampling Algorithm} & Neptune & 0.9999 & 0.9991 & 0.9995 & 16,585 & 41,214 \\  & Nmap & 0.9685 & 0.9898 & 0.979 & 590 & 1493 \\  & Normal & 0.9982 & 0.9987 & 0.9985 & 26,709 & 67,343 \\  & Rootkit & 0.0694 & 1 & 0.1299 & 5 & 10 \\  & Multihop & 1 & 1 & 1 & 7 & 7 \\  & Weighted Avg & 0.9885 & 0.9847 & 0.9847 & 50,378 & 0.9847 \\ \hline \multirow{3}{*}{Bagging Classifier Random Oversampling Algorithm} & Neptune & 0.9999 & 0.9993 & 0.9996 & 16,579 & 41,214 \\  & Nmap & 0.9662 & 0.9967 & 0.9812 & 603 & 1493 \\  & Normal & 0.9994 & 0.9994 & 0.9994 & 26,828 & 67,343 \\  & Rootkit & 0.75 & 1 & 0.8571 & 3 & 10 \\  & Multihop & 1 & 1 & 1 & 4 & 7 \\  & Weighted Avg & 0.9982 & 0.9981 & 0.9981 & 50,390 & 0.9981 \\ \hline \multirow{3}{*}{XGB Classifier Random Oversampling Algorithm} & Neptune & 0.9999 & 0.9999 & 0.9999 & 16,366 & 41,214 \\  & Nmap & 0.9982 & 0.993 & 0.9956 & 568 & 1493 \\  & Normal & 1 & 0.9993 & 0.9996 & 27,123 & 67,343 \\  & Rootkit & 0.5714 & 1 & 0.7273 & 4 & 10 \\  & Multihop & 1 & 1 & 1 & 2 & 7 \\  & Weighted Avg & 0.9996 & 0.9995 & 0.9995 & 50378 & 0.9995 \\ \hline \multirow{3}{*}{Extra Trees Classifier Random Oversampling Normal 1 Algorithm} & Neptune & 0.9999 & 1 & 16,462 & 41,214 \\  & Nmap & 1 & 0.9951 & 0.9975 & 613 & 1493 \\  & Normal & 0.9999 & 0.9994 & 0.9996 & 26,852 & 67,343 \\  & Rootkit & 0.8 & 0.8 & 0.8 & 5 & 10 \\  & Multihop & 1 & 1 & 1 & 4 & 7 \\  & TRFSMOTE & Weighted Avg & 0.9996 & 0.9995 & 0.9995 & 50,420 & 0.9995 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Classification report for the validation set of NSL-KDD dataset, comprising different algorithm and sampling technique combinations within the RLFOUA framework for infiltration attack, arranged in ascending order of performance metrics. ### Primary Testing on Independent Set for CSE-CIC-IDS2018

In this section, we test the RLFOUA framework on the CSE-CIC-IDS2018 dataset.