## 4 Experiments
### Results and Analysis  
#### 4.2.1 Overall Performance Comparison  
The experimental results demonstrate that ARCS's performance significantly varies across the different attack characteristics present in our dataset. Table 3 presents a comprehensive comparison between ARCS and the baseline methods across all evaluation metrics. \begin{table}
\begin{tabular}{l c} \hline
**Parameter** & **Value** \\ \hline Batch Size & 128 \\ Learning Rate & \(1\times 10^{-3}\) \\ Discount Factor (\(\gamma\)) & 0.99 \\ Experience Buffer Size & \(1\times 10^{6}\) \\ Target Network Update Frequency & 1000 steps \\ Training Episodes & 10,000 \\ \hline \end{tabular}
\end{table} 
Table 2: Hyperparameter configuration. ARCS achieved an overall 89.2% success rate in threat mitigation, with performance notably correlated with attack complexity and temporal patterns. For high-volume attacks like DDoS, which constitute 28.3% of the dataset, ARCS achieved its highest success rate (92.3%) due to their repetitive patterns and clear signatures. The response time for DDoS attacks averaged 18.7 s, significantly faster than the overall average of 23.5 s, as the model effectively leverages pattern recognition in high-volume, similar events. In moderate-complexity attacks such as malware and phishing (combined 43.2% of dataset), the system maintains strong performance by effectively utilizing the temporal dependencies captured in the state representation module. The dual-stream architecture proves particularly effective here, balancing immediate response needs with strategic defense planning. For complex threats including insider attacks and ransomware (combined 28.5% of dataset), while still outperforming baselines, ARCS showed relatively lower success rates. This variation can be attributed to the sophisticated nature of these attacks and their unique characteristics, which often deviate from common patterns in the training data. The system's response time performance showed substantial enhancement, with ARCS requiring an average of 23.5 s to implement appropriate countermeasures. This represents a 13.9% improvement over HRDL and a more significant 48.5% reduction compared to traditional rule-based approaches. The reduction in response time is crucial for minimizing potential damage from rapid-spreading threats, particularly in cases of ransomware and DDoS attacks where every second is critical. ARCS demonstrates remarkable precision in threat detection and response, achieving a false positive rate of 3.9%. This performance represents a meaningful improvement over existing approaches, with HRDL and A3C-Security showing FPRs of 4.7% and 5.2%, respectively. The significant reduction in false positives directly addresses one of the major challenges in operational security environments--alert fatigue among security personnel. When compared with recent approaches like ACNN and DRL-Sim, ARCS demonstrates several key innovations and improvements. While ACNN (86.8%) and DRL-Sim (84.9%) show promising results in their specialized domains of zero-day attack detection and attack pattern recognition, respectively, ARCS's dual-stream architecture enables more comprehensive threat response capabilities. The significant reduction in false positive rates (3.9% compared to ACNN's 4.9% and DRL-Sim's 5.1%) showcases the effectiveness of our novel hierarchical state representation and temporal attention mechanism. Furthermore, ARCS's unique ability to simultaneously optimize both immediate and strategic responses, evidenced by its superior system stability score (0.88), represents a fundamental advancement over existing approaches that typically focus on either immediate detection or long-term strategy. Moreover, ARCS excels in real-time performance, achieving a 92.5% RPI, which is significantly higher than the baselines and recent approaches. This indicates that ARCS