## 3 Experiments
### Experimental Analysis
#### 3.4.4 Experiment 4 Optimization Algorithm Evaluation  
In the preceding multiple sets of experiments, a comparative study was conducted between our proposed algorithm and traditional classical machine learning algorithms in binary and multiclass tasks. The results confirmed that our algorithm significantly outperforms the traditional methods in various evaluation metrics for binary and multiclass experiments. The analysis based on evaluation metrics demonstrates the algorithm's capability to effectively address the challenges posed by high dimensionality and class imbalance. Moreover, the optimized algorithm exhibits strong generalizability, as evidenced by its excellent performance across diverse datasets. To ensure the scientific rigor of the experimental results, a comprehensive performance comparison was further conducted between our algorithm and a series of state-of-the-art network intrusion detection methods. Given the deployment environment of practical Internet of Things (IoT) systems, the focus was placed on analyzing the comparative performance of multiple algorithms in the binary classification scenario, where the higher cost lies in correctly distinguishing between normal and intrusive traffic data rather than classifying various types of intrusions. The detailed comparison results are presented in Table 20.  
Through comprehensive comparative analysis of various indicators, the proposed algorithm in this study demonstrated significant superiority over NSL-KDD, UNSW-NB15, and CICIDS-2017 datasets. Given the high dimensionality and data imbalance of the datasets, we first selected features that could best represent the original data, reducing the spatial complexity and dimensionality of the dataset. Subsequently, by oversampling the minority class data, we successfully addressed the issue of data class imbalance. After effective feature engineering, we input the reduced dataset into subsequent classification algorithms, significantly reducing the spatial complexity and the number of features for each data point, thereby reducing the overall dataset size and alleviating the computational burden of the algorithm. Considering the intrusion detection application environment, where most dataset represents normal class samples, we focused on the minority class representing the attack category. Hence, the model combined SMOTE algorithm to enhance the proportion of the minority class, thereby increasing the algorithm's sensitivity to the minority class data and improving the accuracy of data classification. Consequently, our algorithm exhibits significant superiority in binary classification tasks for network intrusion detection. \begin{table}
\begin{tabular}{c c c c c c c} \hline  & \multicolumn{6}{c}{**CICIDS2017 Dataset Performance Comparison**} \\  & & \multicolumn{3}{c}{**Accuracy**} \\ \hline  & SVM & LR & XGBoost & LightGBM & Catboost & Algorithm of this paper \\  & [44; 45; 46] & [47; 48; 49] & [50; 51] & [53; 54] & [55; 56; 57] & Algorithm of this paper \\ BENIGN & 67.82\% & 91.50\% & 98.79\% & 99.24\% & 99.36\% & 99.72\% \\ PortScan & 44.87\% & 48.06\% & 45.60\% & 62.74\% & 59.24\% & 89.81\% \\ Patator & 88.79\% & 87.64\% & 97.25\% & 98.58\% & 97.83\% & 99.24\% \\ DoS & 52.29\% & 52.78\% & 94.95\% & 97.54\% & 96.23\% & 99.91\% \\ Web & 0 & 0 & 90.43\% & 95.71\% & 93.87\% & 96.92\% \\ Others & 0 & 0 & 63.13\% & 59.77\% & 65.92\% & 69.84\% \\ \hline \end{tabular}
\end{table} 
Table 19: The proposed model is compared with existing methods in multiple classifications on the CICIDS2017 dataset. However, it is essential to note that despite demonstrating significant advantages in experiments, our method still has some limitations. For instance, the algorithm may have limited generalization performance and feature representation capabilities, as its performance could be influenced by the quality and quantity of features extracted from network data. Therefore, further research on feature engineering may be necessary to improve its effectiveness.