## 5 Results
### Training Models  
* The Random Forest and XGBoost models were trained using 5-fold cross-validation combined with hyperparameter optimization through GridSearchCV, applied to the balanced and preprocessed training datasets (CIC-DDoS2019 and N-BaIoT). This procedure enabled the identification of optimal configurations that significantly improved model performance. The evaluated hyperparameter ranges were defined based on prior literature and empirical experimentation. For the Random Forest model, the search space included the hyperparameter ranges shown in Table 4, which were defined based on prior literature and empirical experimentation. This selection aimed to thoroughly evaluate the influence of each parameter on classification performance and to ensure robust generalization under varying network traffic conditions. These ranges were selected to comprehensively assess the influence of each hyperparameter on classification performance and ensure robust generalization across varying network traffic conditions. With feature selection using Random Forest: An internal feature selection approach based on the variable importance generated by the Random Forest algorithm itself was used. This technique allowed us to identify the most relevant features, eliminating those that did not provide significant information or introduced noise. The model was subsequently trained using only the selected variables, resulting in greater efficiency and accuracy. With feature selection using XGBoost: In a second configuration, the Random Forest model was maintained, but the features previously selected by the XGBoost algorithm were used. This strategy allowed us to evaluate the impact of an alternative variable selection on the same model. The observed differences in accuracy and training time demonstrate how feature selection directly influences the final performance of the classifier. Training with XGBoost: The XGBoost model was trained as the main classifier on the same datasets. This algorithm, known for its high performance in supervised classification tasks, was tuned using GridSearchCV to identify the optimal hyperparameter settings (such as learning rate, number of trees, and depth). Feature selection was performed using its own gain metric, allowing dimensionality reduction without losing predictive power. This approach proved robust and competitive with other models, standing out for its balance between accuracy and efficiency. Training with LSTM To analyze the behavior of deep-learning techniques, an LSTM (Long Short-Term Memory)-based architecture was implemented using the Keras and TensorFlow libraries. These recurrent neural networks were designed to capture temporal patterns in network traffic data, taking advantage of their ability to handle long-term sequences and dependencies. The training was conducted on the CIC-DDoS2019 dataset, highlighting its usefulness in scenarios where the temporal dynamics of network events are key to effective attack detection. This section presents the experimental evaluation of ML and DL models using the CIC-DDoS2019 and N-BaIoT datasets. As shown in Figure 6, the training curves highlight performance differences between Random Forest, XGBoost, and LSTM. \begin{table}
\begin{tabular}{l l} \hline
**Hyperparametro** & **Valores Evaluados** \\ \hline learning\_rate & \{0.01, 0.1, 0.2\} \\ n\_estimators & \{100, 200, 300\} \\ max\_depth & \{3, 5, 10\} \\ subsample & \{0.5, 0.75, 1\} \\ colsample\_bytree & \{0.5, 0.75, 1\} \\ \hline \end{tabular}
\end{table} 
Table 4: Hyperparameter ranges evaluated for XGBoost using GridSearchCV. The training outcomes demonstrate distinct performance patterns across the models. Random Forest achieved near-perfect accuracy with a consistently decreasing loss curve, reflecting robust generalization and rapid convergence. XGBoost followed with slightly lower but stable performance, reaching approximately 98% accuracy. Conversely, LSTM exhibited slower convergence, lower final accuracy (85%), and higher residual loss, indicating challenges in model optimization.