## 4 Results
### Classification Performance Overview  
The analysis begins with a review of the training dynamics using accuracy curves, and continues with an assessment of the models' ability to generalize based on an independent test set. This approach allows for evaluating not only the models' capacity to fit the training data, but also their effectiveness in handling previously unseen instances. Figure 3 presents the training and validation accuracy curves for both XGBoost and TabNet across the full training process. The plot reveals a consistent improvement in both the training and validation phases, with XGBoost and TabNet achieving comparable validation performance towards the end of training. Specifically, XGBoost reaches a validation accuracy of 97.8%, while TabNet attains 97.68%. While both models perform well on validation data, XGBoost demonstrates a slight advantage in test generalization. This may be due to its ensemble-based structure, which can better capture feature interactions and mitigate the effects of class imbalance. In contrast, TabNet may be more sensitive to rare class misclassifications, potentially affecting its robustness in the case of unseen data. To further assess generalization, we examined the models on the held-out test set, where XGBoost achieved a test accuracy of 85.91%, slightly outperforming TabNet, which achieved an accuracy of 84.41%. The discrepancy observed between the validation and testing accuracy for both models suggests a moderate degree of overfitting. Nonetheless, both exhibited a strong discriminative capacity during training. The discrepancy between the validation and testing phases indicates overfitting in both models, although each demonstrated strong discriminative capacity during training. It is important to clarify that the x-axis does not represent the proportion of training data used, but rather the relative progress of training for each model. In the case of XGBoost, this corresponds to the number of completed boosting rounds (up to 100), while for TabNet, it reflects the number of training epochs. Both models were trained using early stopping based on validation loss to prevent overfitting, and the curves are scaled to show normalized training progression. Accuracy values were monitored incrementally throughout training to illustrate convergence dynamics, offering a visual comparison of how each model learns over time. This approach allowed for a more intuitive assessment of learning behavior and model stability during training, independent of absolute iteration counts. Overall, while both models achieved high validation performance, XGBoost maintained a slight edge in test accuracy. This may be attributed to its ensemble architecture's ability to manage feature interactions in imbalanced data scenarios, whereas TabNet's performance suggests increased sensitivity to rare class misclassification. Figure 4 compares the ROC curves of XGBoost and TabNet on the test set, revealing low discriminative ability in both (macro AUC: 0.37 and 0.43, respectively), confirming the observed overfitting. XGBoost achieves higher overall accuracy (85.91%), benefiting from its architecture in unbalanced scenarios, while TabNet shows a better AUC in specific classes, highlighting its sensitivity to minority classes. Figure 3: Training and validation accuracy for XGBoost and TabNet. The classes are indexed as follows: (0): Analysis, (1): Backdoor, (2): DoS, 3: Exploits, 4: Fuzzers, 5: Generic, 6: Normal, 7: Reconnaissance, 8: Shellcode, and 9: Worms. The model demonstrates high accuracy in identifying common traffic types such as Generic and Normal (indices 5 and 6), with over 95% correct classification. In contrast, categories such as Backdoor, Shellcode, and Worms show higher misclassification rates, reflecting the known challenge of detecting low-prevalence or obfuscated attack types. Notably, Analysis traffic (class 0) is often misclassified as Exploits (class 3), suggesting feature overlap between these classes.