# Explainable Lightweight Block Attention Module Framework for Network-Based IoT Attack Detection
## 4 Experimental Results
### Discussion
#### 4.2.3 Performance Evaluation on the UNSW-NB15 Dataset  
Table 6 displays the outcomes of the proposed method's multi-class categorization using the UNSW_NB15 dataset. The multi-class categorization performance of the suggested method was outstanding and produced the best results for each attack class, as seen from the table. For every class, ACC rates were greater than 99%. The benign, DDoS, and DSproto classes achieved exceptional performance, with ACC rates of 99.94%, 99.83%, and 99.81%, respectively. The categorization performance on other assault categories also delivered the most significant result. Figure 7 shows a graphic depiction of Table 6.  
According to the figure, the proposed classification model performed less optimally on the \"sLoss\" and \"sWin\" classes compared to other label types. Through testing, we discovered that the properties of \"sLoss\" and \"sWin\" shared many of the same features. Therefore, to correctly classify the traffic data of these classes, the classifiers need more significant features, because our model combines the efficient ABC algorithm to select significant features. However, the overall model accuracy in distinguishing target classes was quite high for \"sLoss\" and \"sWin\" target labels, at 99.00% and 99.28%, respectively. This will lead to improving the overall accuracy of the classifier. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Techniques** & **Precision** & **Recall** & **F1** & **Accuracy** \\ \hline
**Benign** & 99.94 & 99.86 & 99.85 & 99.89 \\ \hline
**DSproto** & 99.81 & 99.64 & 99.63 & 99.62 \\ \hline
**sbytes** & 99.47 & 99.5 & 99.48 & 99.55 \\ \hline
**sLoss** & 99.00 & 99.04 & 99.02 & 99.02 \\ \hline
**Service** & 99.53 & 99.57 & 99.55 & 99.62 \\ \hline
**Sload** & 99.59 & 99.56 & 99.54 & 99.45 \\ \hline
**sWin** & 99.28 & 99.31 & 99.28 & 99.32 \\ \hline
**stepb** & 99.31 & 99.34 & 99.17 & 99.38 \\ \hline
**Fuzzers** & 99.38 & 99.42 & 99.34 & 99.42 \\ \hline
**Backdoor** & 99.35 & 99.38 & 99.36 & 99.45 \\ \hline
**DoS** & 99.58 & 99.21 & 99.2 & 99.25 \\ \hline
**DDoS** & 99.83 & 99.15 & 99.11 & 99.00 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Evaluation of proposed model on UNSW-NB15 dataset. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Techniques** & **Pre** & **Recall** & **F1** & **Acc** \\ \hline Decision tree [64] & 97.5 & 85 & 90 & 96.67 \\ \hline DNN [65] & - & - & 96 & - \\ \hline
1D-CNN [66] & - & - & - & 98.96 \\ \hline Adaboost [67] & 81.83 & 100 & 90.01 & 81.83 \\ \hline RNN [68] & 96 & 97 & 96 & 98 \\ \hline
**Proposed** & **99.19** & **99.15** & **99.17** & **99.26** \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison of the proposed model on CICIDS2017 dataset. The suggested technique's comparison to various existing intrusion detection algorithms is shown in Table 7 and Figure 8. The existing techniques, such as radial basis function neural network (RBFNN), Bayes point machine (BPM), explainable neural network (XNN), and convolutional neural network (CNN) were used. From the table, it is observed that the proposed strategy attained 99.58% accuracy compared to all the other state-of-the-art methods on the UNSW_NB15 dataset; also, it is observed that the overall accuracy was improved with CNN more than other methods. This might be due to the fact that the correlation between target features is better learned by a convolution kernel than other shallow networks. However, in terms of precision, all the techniques achieved better results. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Techniques** & **Precision** & **Recall** & **F1** & **Accuracy** \\ \hline BPM [69] & 98.00 & 97.00 & 97.00 & 97.00 \\ \hline RBFNN [70] & 98.10 & 97.40 & 97.10 & 97.10 \\ \hline XNN [71] & 99.00 & 99.20 & 99.00 & 98.10 \\ \hline CNN [72] & 99.33 & 99.19 & 99.13 & 99.13 \\ \hline
**Proposed** & **99.69** & **99.45** & **99.42** & **99.58** \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Ablation of proposed architecture on UNSW_NB15 dataset.