## 5 Discussion
### Performance Analysis  
For binary classification tasks, all models except the MLP and DNN performed exceptionally well with accuracy, precision, recall, and F1-score all around 0.95 and an ROC-AUC of 0.99. The MLP had a slightly lower performance with an accuracy of 0.89 and ROC-AUC  
Figure 6: ROC-AUC score–Random Forest. \begin{table}
\begin{tabular}{l l l l l l l} \hline \hline
**Actual/Predicted** & \begin{tabular}{l} **Brute** \\ **Force (B)** \\ \end{tabular} & **DoS (D)** & **Flood (F)** & \begin{tabular}{l} **Legitimate** \\ **(L)** \\ \end{tabular} & \
\begin{tabular}{l} **Malformed** \\ **(M)** \\ \end{tabular} &
\begin{tabular}{l} **SlowlTe** \\ **(S)** \\ \end{tabular} \\ \hline Brute Force (B) & TP (BB) & FP (BD) & FP (BF) & FN (BL) & FP (BM) & FP (BS) \\ DoS (D) & FP (DB) & TP (DD) & FP (DF) & FN (DL) & FP (DM) & FP (DS) \\ Flood (F) & FP (FB) & FP (FD) & TP (FF) & FN (FL) & FP (FM) & FP (FS) \\ Legitimate (L) & FP (LB) & FP (LD) & FP (LF) & TP (LL) & FP (LM) & FP (LS) \\ Malformed (M) & FP (MB) & FP (MD) & FP (MF) & FN (ML) & TP (MM) & FP (MS) \\ SlowlTe (S) & FP (SB) & FP (SD) & FP (SF) & FN (SL) & FP (SM) & TP (SS) \\ \hline \hline \end{tabular} (c) ROC-AUC: The approach used to compute ROC-AUC in the multiclass case differs from that in binary classification. A standard method in the literature is to produce one ROC curve for each class, treating each class as the positive class and all others as negative [51]. We computed the ROC-AUC using the One-vs.-Rest (OvR) approach for the multiclass classification. The AUC was evaluated and reported as a weighted average to account for class imbalances. For the sake of brevity, we present Figure 6, the ROC-AUC scores for the RF model. The ROC-AUC scores for the other six models are provided in the Appendix A (see Figure A2).  
\end{table} 
Table 9: Description of multiclass classification confusion matrix. of 0.95 (see Table 6). The DNN, however, had a significantly lower performance with an accuracy of 0.81 and an ROC-AUC of 0.92. Nevertheless, the confusion matrices (see Figure 3) provided deeper insights. The DNN, despite its lower overall accuracy, achieved the highest number of true positives (49,195) and the fewest false negatives (447). However, it also exhibited a significantly high number of false positives (18,821), as reflected by its elevated FPR in Figure 7. This suggests that while the DNN is very sensitive (high recall), it lacks specificity, resulting in high false alarms. In real-time production environments, this behavior of the DNN may be undesirable as it leads to excessive false alarms and inefficient resource utilization. Conversely, the MLP had more false negatives (10,216) and fewer false positives (463). This indicates that the MLP missed more actual attacks (low recall) but generated fewer false alarms. This trade-off is critical in intrusion detection systems, where missing an attack (high FN) can cause more significant damage than having false alarms. In the multiclass case, the class distribution was highly imbalanced, with legitimate traffic making up the majority and flooding attacks being the rarest. The performance metrics for the multiclass classification models are presented in Table 8. The RF, DT, GB, and XGBoost models achieved decent accuracy, precision, recall, and F1-scores around 0.90. LR and MLP classifier had lower performance, with accuracies of 0.79 and 0.82, respectively. The DNN again had the lowest performance, with an accuracy of 0.78. The confusion matrices for multiclass classification (see Figures 5 and A1) highlight that most misclassifications occurred in classes with fewer samples, such as malformed, SlowITe, and flooding. Hence, the models may benefit from further tuning or more sophisticated techniques to handle the rare classes effectively. As depicted in Figure 8, the computational time varied significantly across models both in binary and multiclass cases (see also Tables 6 and 8). DT, RF, and LR were the fastest. GB and XGBoost required slightly longer training times compared to the fastest models.