## 4 Results and Discussion
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c} \hline
**Class/Prediction** & **Class/Prediction** & **Class/Prediction** & **Class/Prediction** & **Class/Prediction** & **Class/Prediction** & **Class/Prediction** & **Class/Prediction** & **Class/Prediction** & **Class/Prediction** \\ \hline
**Normal** & 272,800 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ \hline
**DDoS\_UDP-based attack** & 0 & 24,313 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ \hline
**DDoS\_JCM-based attack** & 0 & 0 & 13,482 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ \hline
**DDoS\_ICT-based attack** & 0 & 0 & 0 & 10,012 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ \hline
**DDoS\_FITC-based attack** & 0 & 0 & 0 & 0 & 8922 & 0 & 0 & 97 & 0 & 0 & 0 & 680 & 0 & 0 \\ \hline
**SOL\_injection-based attack** & 0 & 0 & 0 & 0 & 7217 & 2134 & 0 & 814 & 0 & 0 & 0 & 0 & 0 & 0 \\ \hline
**Password-based attack** & 0 & 0 & 0 & 0 & 5293 & 3075 & 0 & 899 & 0 & 0 & 0 & 0 & 0 & 0 \\ \hline
**Vulnerability, scanner-based attack** & 0 & 0 & 0 & 1100 & 0 & 8504 & 0 & 0 & 0 & 401 & 0 & 0 & 0 \\ \hline
**Uploading-based attack** & 0 & 0 & 0 & 0 & 2797 & 1031 & 0 & 3353 & 0 & 0 & 0 & 0 & 0 & 0 \\ \hline
**Backdoor-based attack** & 0 & 0 & 97 & 0 & 0 & 0 & 0 & 0 & 4132 & 0 & 0 & 576 & 0 & 0 \\ \hline
**Port, Scanning-based attack** & 0 & 0 & 0 & 1997 & 0 & 0 & 0 & 0 & 0 & 1998 & 0 & 0 & 0 & 0 \\ \hline
**XXS-based attack** & 0 & 0 & 0 & 1687 & 0 & 0 & 211 & 0 & 0 & 0 & 1115 & 0 & 0 & 0 \\ \hline
**Ransomware-based attack** & 0 & 0 & 0 & 78 & 0 & 0 & 0 & 0 & 0 & 213 & 0 & 0 & 1647 & 0 & 0 \\ \hline
**MITMR-based attack** & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 72 & 0 \\ \hline
**Fingerprinting-based attack** & 0 & 7 & 3 & 26 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 26 & 0 & 109 \\ \hline \end{tabular}
\end{table} 
Table 8: Classification results for 15-class. The weighted multiclass classification results (in 15-class classification, see Table 8) also reached very high values, taking into account the complexity of 15-class classification, reaching a precision of 95.02%, a recall of 94.72%, and an F1 score of 0.946. For normal traffic and MITM-based attacks, there were no errors in classification (no false positives or negatives), thus reaching scores equal to 1 (100%). Almost the same results were obtained for DDoS_UDP-based and DDoS_ICMP-based attacks, reaching very high classification rates (F1 scores of 0.999). It is noticeable that some attacks with low representation in the dataset (such as e.g., MITM-based attacks) reached very good classification results, demonstrating that some attacks with particular traffic patterns could be identified by the proposed method. On the other hand, attacks such as XSS-based (F1 = 0.428), password-based (F1 = 0.448), uploading-based (F1 = 0.561), and SQL_injection-based (F1 = 0.567) attacks presented many more classification errors due to confusion between the specific type of attack. It would, therefore, be interesting to analyze in the future which types of attacks are confused with each other in order to take into account the inclusion of additional parameters or attributes of the IIoT traffic that would allow for better distinction between these types of attacks. Table 9 presents the CNN model's performance in binary classification across different epochs and learning rates, demonstrating excellent results for intrusion detection. With each epoch, the model's accuracy steadily improved, ultimately reaching 1.0, showing a strong capability in accurately identifying samples. The loss value also decreased markedly and approached zero, highlighting significant improvements in the model's learning. Furthermore, validation accuracy reached 1.0, indicating effective generalization to new data. Training and validation times were consistently efficient, reflecting an optimized learning process. These findings underscore the CNN model's success in binary intrusion detection and its practical potential for real-world applications.