## 4 Experimental Simulations
### Dataset and Evaluation Criteria  
Over the years, many datasets related to intrusion detection have been introduced for research and development, including KDDCup99 [51], UNSW-NB15 [52], NSL-KDD [53], CIC-IDS2017 [54] and LITNET-2020 [55]. In this paper, we choose to use the UNSW-NB15, NSL-KDD and CIC-IDS2017 datasets to evaluate the proposed model. These datasets are the more widely used datasets in the existing intrusion detection field. The NSL-KDD dataset is a relatively early dataset applied to the field of intrusion detection, and the related research is more mature. UNSW_NB15 and CIC-IDS2017 are recent datasets that can better reflect the real network environment. The specific descriptions of the three datasets are shown below. The NSL-KDD dataset is an improvement of the KDD99 dataset, which removes the redundant and duplicate data from the training and testing sets on the basis of the KDD99 dataset, so that the training and testing sets are set up in a more reasonable way. It mainly contains 41-dimensional attribute features and one-dimensional category features, covering five types of Normal, Probe, Dos, R2L, U2R. The distribution of different categories of attacks in the dataset is shown in Table 3. \begin{table}
\begin{tabular}{c c} \hline \hline
**Model Parameters** & **Parameter Settings** \\ \hline Batch size & 1024 \\ Loss function & SparseCategoricalCroscentropy \\ Optimizer & SGD \\ Optimizer learning rate & 0.001 \\ Epoch & 200 \\ Resblock + CBAM & 64 \\ GRU & 32/64/128 \\ Dropout & 0.5 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Model parameter settings. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Dataset**} & \multicolumn{5}{c}{**Attack Behavior**} & \multirow{2}{*}{**Total**} \\ \cline{2-2} \cline{4-6}  & **Normal** & **Dos** & **Probe** & **R2L** & **U2R** \\ \hline KDDTrain+ & 67,343 & 45,927 & 11,656 & 995 & 52 & 125,973 \\ KDDTest+ & 9889 & 7460 & 2707 & 2421 & 67 & 22,544 \\ Total & 77,232 & 53,387 & 14,363 & 3416 & 119 & 148,517 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Distribution of different attack behaviors in the NSL-KDD dataset. The UNSW-NB15 dataset is a new dataset generated in 2015 by the Cyber Range Laboratory of the Australian Centre for Cyber Security (ACCS) using the IXIA PerfectStorm tool to simulate realistic cyber environments. The dataset mainly consists of 47 attribute features and two category features, and contains nine attack techniques: Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode, Worms. In this paper, we directly use the initial training set and testing set to test the performance of the model. The distribution of different categories of attacks in the dataset is shown in Table 4.  
The CIC-IDS2017 dataset is derived from the 3-7 July 2017 Canadian Institute for Cybersecurity (CIC) collection for cyber data, which contains benign as well as recent common attacks in the field of cyber intrusions, filling the gap of no cyber-based attacks in the UNSW-NB15 dataset. The dataset contains 78-dimensions of attribute features and one-dimension of category features covering 15 attack types. In this paper, the anomalous behaviors of a similar nature are merged, and the final dataset contains nine types of attacks: Benign, Dos, Portscan, Ddos, Patator, Bot, Web attack, Infiltration, and Heartbleed. The distribution of different categories of attacks in the dataset is shown in Table 5.  
The evaluation metrics of the network security intrusion detection model include four main metrics: precision, accuracy, recall, and F1-score. In the specific detection results, T (true) and F (false) represent correctly or incorrectly classified data, respectively. P (positive) and N (negative) indicate that the predicted results of the detection system are abnormal or normal data, respectively. All data in the dataset must be classified into four categories: _TP_, _TN_, _FP_ and _FN_.