## 4 Evaluation and Performance Optimization
### Datasets for Evaluation
5G-NIDD contains both attack traffic and legitimate traffic across various attack scenarios, such as port scans and DoS attacks, using real mobile devices to generate benign traffic, a more realistic dataset. 5G-NIDD datasets focus on 5G-specific vulnerabilities, a key area of concern for next-generation communication networks. Unlike traditional datasets, 5G-NIDD captures non-IP traffic scenarios, which are pivotal in IoT and machine-to-machine (M2M) communication within 5G networks. With the growing number of IoT devices in communication networks, the 5G-NIDD dataset provides insights into potential vulnerabilities, such as traffic hijacking, spoofing attacks, and unauthorized device communication. Combining CIC_IDS2019 and 5G-NIDD provides a holistic approach: CIC_IDS2019 addresses traditional communication protocols and attack types prevalent in legacy and transitional communication networks; and 5G-NIDD captures next-generation protocols and vulnerabilities in 5G-enabled systems, providing critical insights for future-ready communication systems. In addition, both datasets provide labelled traffic data, making them suitable for developing and testing machine learning and AI-driven detection systems for intrusion detection, anomaly-based detection, signature-based systems, and hybrid detection models that require input from both legacy and emerging network protocols. In our study, using these datasets, we simulated two attack scenarios and adopted GA for training towards achieving a robust detection system that is adaptable to hybrid communication environments combining 4G, 5G, and IoT systems. The CIC-IDS2019 and 5G-NIDD datasets are labeled and contain over 80 and 51 network flow features, respectively, in a tabular format (comma-separated values, CSV) for easy analysis and model training. The CIC-IDS2019 and 5G-NIDD datasets underwent a preprocessing stage to prepare it for model training. Initially, irrelevant features, such as timestamps and IP addresses, were removed, as they did not contribute significantly to identifying benign or malicious flows. Categorical features were then converted into numerical values using one-hot encoding. Low-frequency categories were aggregated into an 'other' category to address the high cardinality of categorical features. This step prevented the encoding of qualitative values present in very few samples, ensuring that the encoded features were relevant to the classification task. The training time and resource requirements for GA in communication networks highly depend on population size, dataset, and complexity, as well as fitness computational cost. In our study, the mutation probability and crossover parameters were heuristically selected for optimal feature importance; the optimal parameters are presented in Figures 5 and 6, respectively. There was considerable improved training time when it was run on Google Colab with GPU resources with about a quarter of the training time with the important features. The CIC-IDS2019 dataset was then randomly split into training and evaluation sets using the holdout method, with 70% of the data allocated for training and 30% for evaluation. Stratification was employed to maintain the original class proportions in both sets. The final CIC-IDS2019 dataset consisted of eight imbalanced classes and 83 features, including 58 numerical and 25 categorical features; the 5G-NIDD dataset consisted of eight imbalanced classes and 50 features, including 45 numerical and 5 categorical features.