## 4 Discussion  
One very important observation during our implementation is that altering the number of features has a significant effect on accuracy. With fewer features, if the accuracy of an algorithm fluctuates less, then it is regarded as a robust algorithm. Such an algorithm can be trained with the minimum number of features giving high accuracy. We can take the deviation of accuracy as a measure of the robustness of the algorithm. Figure 9 not only shows us overall accuracies but also shows us the aberrrative behavior \begin{table}
\begin{tabular}{p{85.4 pt} p{85.4 pt} p{85.4 pt} p{85.4 pt}} \hline \hline
**Model** & **Training Time (Seconds)** & \begin{tabular}{c} **Testing Time** \\ **(Seconds per 1M** \\ **Samples)** \\ \end{tabular} & \begin{tabular}{c} **Reasoning** \\ \end{tabular} \\ \hline Logistic Regression & 20–60 & 2–5 & \begin{tabular}{c} Training involves solving a convex optimization problem; testing is fast (matrix multiplication). \\ \end{tabular} \\ \hline Support Vector Machine & 1000–3000+ & 100–300 & \begin{tabular}{c} SVM training scales poorly with large datasets \\ (quadratic/cubic complexity); testing depends on support vector count. \\ \end{tabular} \\ \hline K-Nearest Neighbors & \(\sim\)10 (Minimal training) & 500–1000 & \begin{tabular}{c} Training is minimal (storing data); testing involves distance calculations for 3M training points. \\ \end{tabular} \\ \hline Decision Tree & 30–120 & 1–5 & \begin{tabular}{c} Training time depends on tree depth; testing is very fast as it involves traversing the tree. \\ \end{tabular} \\ \hline Random Forest & 300–1000+ & 10–50 & \begin{tabular}{c} Training scales with the number of trees and their depth; testing averages predictions across trees. \\ \end{tabular} \\ \hline Naive Bayes & 5–15 & 1–3 & \
\begin{tabular}{c} Training and testing are very efficient due to simplicity (based on probabilities). \\ \end{tabular} \\ \hline Artificial Neural Networks & 2000–5000+ & 50–200 &
\begin{tabular}{c} Training depends heavily on architecture, epochs, and batch size; testing requires forward passes for all samples. \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Training and testing time for machine-learning models on a dataset with 3 million samples and 14 features (32 GB RAM). of algorithms when encountered with the challenge of a smaller number of algorithms. From Table 3 and Figure 9, we can clearly see that the Random Forest not only gives the highest accuracy of all the algorithms but it is also worth noting that with all feature sets, it exhibits very little change in accuracy and all four accuracy columns are of nearly the same length. The same behavior can be observed for the Naive Bayes algorithm, which also has higher accuracy and a little aberration in all the accuracies with respect to different feature sets. One important point can also be noted for ANN. Although ANN gives less accuracy as compared to RF and NB, it also shows little fluctuation in accuracy when encountering the challenge of a smaller number of available features. The reason is that ANN is an algorithm that can be trained with very small available information. By contrast, algorithms like Logistic Regression, KNN, and DT give us less overall accuracy and high aberration in accuracy with different feature sets. Besides accuracy, we have further evaluated the performance of our models using parameters like Precision, Recall, Fl Score, and Specificity. Precision tells how precise a model is by determining the actual positive instances out of the predicted positive. The Recall parameter calculates the correct positive predictions out of all the desired positive predictions. The F1 Score is also an important metric that is used when unbalanced data are used. F1 Score weights Precision and Recall equally. Specificity gives the true positive rate. To correctly calculate the Recall and F1 Score, we have used a scale of 500 records. The reason for this scaling is that the dataset contains more attack records than normal traffic.