## 5 Results and Analytical Discussion
### Algorithm Performance Comparison
#### 5.1.2 Misclassification Analysis  
Examining the confusion matrix closely produced important new understanding of misclassifications between several DDoS variations. Four different DDoS attack forms are included in the dataset: DDoS_HTTP, DDoS_ICMP, DDoS_TCP, and DDoS_UDP. Table 2 shows that classification performance for each DDoS type differed significantly between models in the base run. Note that all percentages results are rounded to one decimal place for clarity. Figure 1: Comparison of performance metrics across all evaluated models. With only one false negative noted across all DDoS classes, RFC showed a remarkable accuracy for all DDoS variations. Particularly, all DDoS_HTTP (2123 samples), DDoS_TCP (2075 samples), and DDoS_UDP (2890 samples) were correctly identified; DDoS_ICMP had only one misclassification out of 2554 samples. Additionally, RFC demonstrated remarkable non-DDoS attack detection with only four cases across 18,798 samples, including single misclassifications in Port_Scanning and Uploading categories, and two cases in XSS classification. These exceptionally high accuracy rates across multiple algorithms (RFC 99.99%, CNN 99.80%, SVM 99.26%) raise important considerations regarding potential overfitting to the Edge-ItoTset dataset characteristics. Such uniformly high performance may indicate that models have learned dataset-specific patterns rather than generalizable attack signatures, particularly given the controlled laboratory environment in which the data were collected. For most DDoS variations, CNN performed remarkably well; however, it showed particular flaws with DDoS_UDP, where 12 cases were misclassified as DDoS_ICMP. This misclassification pattern indicates that the network traffic patterns of these attack types, which challenged CNN's feature extraction capabilities, are similar. The performance of KNN variants varied depending on the DDoS types. For DDoS_HTTP attacks, KNN (K = 3) misclassified 502 instances (23.6%) as XSS attacks, and 56 instances (2.6%) as Vulnerability_scanner. Similarly, KNN (K = 5) misclassified 504 cases (23.7%) as XSS and 64 instances (3.0%) as vulnerability scanner attacks. With 527 occurrences (24.8%) misclassified as XSS, and 51 instances (2.4%) as vulnerability scanner attacks, KNN (K = 7) displayed similar misclassification rates. With misclassification rates of 19.9% (412 instances), 19.8% (410 instances), and 19.5% (404 instances), KNN variants K = 3, 5, and 7 misclassified DDoS_TCP attacks as Port_Scanning attacks, respectively. Remarkably, KNN (K = 3) also misclassified 28 DDoS_TCP instances (1.3%) as backdoor attacks, 3 instances (0.14%) as fingerprinting, and 1 instance (0.05%) as ransomware giving a total of 21.4% misclassification rate for KNN (K = 3). DDoS_ICMP exhibited rather good detection across the KNN versions, with misclassification rates below 1%, mostly as fingerprinting attacks (11, 13, 14 instances misclassified for K = 3, K = 5, and K = 7, respectively). SVM showed different performance depending on the DDoS type. It performed poorly for DDoS_TCP with just 56.9% (1181 instances) correctly classified and a total misclassification rate of 43.1%, including 41.2% (855 instances) misclassified as Port_Scanning attacks and 1.9% (39 events) misclassified as ransomware attacks. For DDoS_ICMP, it successfully classified 99.65% of instances with only 0.35% misclassification. With 37.9% (804 instances) misclassified as XSS attacks and 1.5% (33 instances) as Vulnerability_scanner attacks, SVM precisely classified just 60.6% (1286 cases) for DDoS_HTTP, giving a total misclassification rate of 39.4%. For most DDoS variations, LSTM performed well; however, it showed certain challenges with DDoS_ICMP, misclassifying 10 cases (0.39%) as DDoS_UDP attacks. This pattern is consistent with CNN's behavior and suggests that these attack categories share