## 5 Discussions  
The proposed Hybrid AE-ELM IDS framework exhibits promising performance in efficiently detecting malicious network traffic with high accuracy and low computational cost. The integration of Autoencoders for dimensionality reduction compresses 80 original features into 18, significantly reducing input complexity while retaining essential patterns for effective classification. This transformation not only minimizes redundancy and noise but also enhances computational efficiency, which is critical for real-time environments.  
The ELM, employed as the classifier, demonstrates excellent generalization and fast training performance across various hidden node configurations. The evaluation shows that an ELM configuration with 500 hidden nodes achieves the highest detection accuracy (98.52%) and F1-score (98.51%), with only marginal increases in training and testing times. This highlights the framework's suitability for time-sensitive applications where rapid threat detection is essential.  
The proposed system outperforms several benchmark models, including SVM (Linear), CNN (Inception), and DBN, in terms of accuracy, precision, recall, specificity, and F1-score. Notably, it also achieves a higher Area Under the ROC Curve (AUC = 0.92), confirming its superior discriminative capability. These findings underscore the hybrid model's strength in classifying both benign and malicious traffic even under diverse and large-scale network conditions.  
The framework's adaptability is a key strength. By applying dynamic thresholds and flexible classification strategies, it can adjust to variations in network behavior and evolving attack patterns. This ensures operational relevance, as real-world networks often face novel or stealthy threats. The AE-ELM architecture also supports scalability, allowing the model to handle increasing volumes of traffic without degrading detection performance. These features make the framework well-suited for deployment in live environments to identify both known and previously unseen intrusion attempts.  
\begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Methods** & **Precision** & **Recall** & **Specificity** & **F1-Score** & **Accuracy** \\ \hline SVM (Linear) [31] & 0.9694 & 0.9390 & 0.9744 & 0.9599 & 0.9581 \\ CNN (Inception) [32] & 0.9480 & 0.9428 & 0.8670 & 0.9421 & 0.9428 \\ DBN [33] & 0.9627 & 0.9519 & 0.9302 & 0.9366 & 0.9515 \\ AE [34] & 0.9493 & 0.9514 & 0.9298 & 0.9299 & 0.9299 \\ Proposed & 0.9825 & 0.9879 & 0.9826 & 0.9851 & 0.9852 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Performance comparison of proposed system.  
Figure 9: Receiver Operating Characteristic (ROC) curve of the proposed system.  
However, a notable limitation is that the current system does not explicitly analyze which features contribute most to classifying a sample as malicious. Addressing this in future work--by integrating explainable AI (XAI) techniques or feature attribution methods--could greatly enhance the framework's transparency and actionable insight.  
Overall, the hybrid AE-ELM IDS offers a robust, scalable, and computationally efficient solution for detecting network intrusions. With further work focused on explainability and root-cause analysis, the framework holds strong potential for real-world cybersecurity applications.