## 4 Results  
This section presents the experimental results of the Hybrid AE-ELM IDS framework, assessed using a subset of the CSECIC-IDS2018 dataset, which includes 5,496,470 samples with a balanced distribution of normal and attack traffic instances, divided into a 70:30 train-test ratio. The framework was evaluated using Extreme Learning Machine (ELM) with four different sets of hidden nodes (100, 300, 500, and 600). The experiments were performed in a Python 3.0 environment with T4 GPU (manufactured by NVIDIA, Santa Clara, CA, USA) support on Google Colab to ensure efficient computation. Table 2 presents the hyperparameter configuration used in the proposed model, detailing the setup parameters. The performance of the proposed system is assessed using metrics derived from the confusion matrix. Precision (3) indicates the proportion of true positives among all predicted positives, while Recall (4), also known as Sensitivity, measures the proportion of actual positives that are correctly identified. Specificity (5) refers to the proportion of true negatives correctly identified. F-measure (6) is the harmonic mean of Precision and Recall, providing a balance between the two. Accuracy (7) represents the overall correctness of the model. \[Precision=\frac{True\ Positive}{Predicted\ Positives} \tag{3}\] \begin{table}
\begin{tabular}{l l} \hline \hline
**Hyperparameters** & **Configuration** \\ \hline Hidden layers (Fully Connected) & 1 \\ Hidden Nodes & 36 \\ Latent Nodes & 18 \\ Learning rate & 0.001 \\ Epochs & 37 \\ Batch\_Size & 32 \\ Autoencoder—Optimizer & Adam \\ Hidden Layer—Activation function & ReLU \\ Output Layer—Activation function & Sigmoid \\ ELM-Optimizer & grid search \\ Train Test Split & 70:30 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Hyperparameter configuration of the proposed model. \[Recall=\frac{\text{True\ Positive}}{\text{True\ Positive}+\text{False\ Negative}} \tag{4}\]  
\[Specificity=\frac{\text{True\ Negative}}{\text{True\ Negative}+\text{False\ Positive}} \tag{5}\]  
\[F1-score=\frac{2\,*\,(Precision\,*\,Recall)}{Precision+Recall} \tag{6}\]  
\[Accuracy=\frac{\text{True\ Positive}+\text{True\ Negative}}{\text{Predicted\ Positive}+\text{Predicted\ Negative}} \tag{7}\]  
The key findings in Figure 5 highlight the effectiveness of the Autoencoder (AE) in compressing the high-dimensional dataset from 80 features to 18, while preserving essential information. In Figure 5, the outer layers represent the number of epochs, while the inner vertical layer displays the corresponding mean squared error (MSE) values. Through the reduction of reconstruction error during training, the AE successfully retains the key features of the data while eliminating noise and unnecessary redundancy. The dimensionality reduction process ensures that the compressed feature set is optimized for subsequent anomaly classification, allowing the framework to efficiently process complex network traffic data with enhanced computational effectiveness. The classification phase, utilizing Extreme Learning Machine (ELM), demonstrated excellent accuracy and quick training times, confirming its effectiveness for real-time intrusion detection. The framework effectively managed the extensive CSE-CIC-IDS2018 dataset, with Figures 6 and 7 from the confusion matrix highlighting its scalability and robustness in handling a wide range of network traffic patterns and attack scenarios. In Figure 6, with 100 hidden nodes, the model correctly classified 753,830 benign instances (TN) and 765,659 malicious instances (TP). However, it misclassified 58,812 malicious instances as benign (FN) and 70,641 benign instances as malicious (FP), indicating moderate performance with some misclassifications. In contrast, Figure 7 shows that the model with 500 hidden nodes (HN 500) achieved significantly improved results, correctly classifying 814,562 benign instances (TN) and 810,040 malicious instances (TP).