## 4 Evaluation and Performance Optimization
### Datasets for Evaluation  
We applied the GAOR approach with two network security-related datasets. In both cases, the data were tabular, meaning they were structured as a table with rows representing individual instances and columns representing features. The CIC-IDS2019 dataset is a comprehensive intrusion detection evaluation dataset consisting of labeled network flows collected from a simulated network environment [82]. It includes both benign and malicious traffic, representing a wide range of cyber-attack types, including denial of service (DoS), port scans, web attacks, and command and control attacks, performed on a network with 25 interacting users. Recorded in July 2017 and made publicly available through the Canadian Institute for Cybersecurity, the dataset is designed to provide a realistic and challenging benchmark for evaluating the performance of intrusion detection systems, offering researchers and practitioners a valuable resource for developing and testing ML models. The CIC-IDS2019 dataset is widely regarded as a benchmark dataset for intrusion detection systems (IDS), because it encompasses a variety of attack scenarios, including denial of service (DoS) attacks, distributed denial of service (DDoS) attacks, brute force attacks, web-based attacks (e.g., SQL injection), and botnet and malware activities. These diverse attack types mimic real-world traffic scenarios in communication networks, providing a robust foundation for developing, testing, and benchmarking IDS and anomaly detection systems. Thus, it is ideal for supervised learning tasks and model performance evaluations in detecting communication network threats. \begin{table}
\begin{tabular}{l l} \hline \hline
**Steps** & **Action** \\ \hline \multirow{6}{*}{2: Fitting the GeneticSelectionCV Object} & The initialized GeneticSelectionCV object is fitted to the training data using: \\  & \(\bullet\) selector = selector.fit (X\_train, y\_train). \\  & \(\bullet\) X\_train represents the independent variables (features). \\  & \(\bullet\) y\_train is the target variable. During this step, the algorithm iteratively evaluates \\  & feature subsets using the genetic operations of selection, crossover, and mutation. \\  & Each subset is assessed based on its performance as evaluated by the RF classifier. \\ \hline \multirow{6}{*}{3: Selecting Features} & After fitting, the support\_attribute of the selector object identifies the features that were \\  & deemed most relevant by the GeneticSelectionCV process: \\  & \(\bullet\) selected\_features = X\_train.columns[selector.support\_]. \\  & \(\bullet\) selector.support\_: A Boolean mask indicating which features are selected (True) \\  & \(\bullet\) X\_train.columns: The column names of the training dataset. \\  & \(\bullet\) The resulting datasets with feature importance were subjected to two attacks from \\  & the ART library as presented in Figure 2. \\  & \(\bullet\) print(“Shape of test data with important features from RF (without GA):”, \\  & X\_test\_rf\_important.shape). \\  & \(\bullet\) print(“Shape of test data with important features from RF (with GA):”, \\  & X\_test\_rf\_important\_ga.shape). \\  & \(\bullet\) print(“Shape of test data with important features from XGBoost (without GA):”, \\  & X\_test\_xg\_important.shape). \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _Cont._The dataset includes modern communication protocols (e.g., HTTP, HTTPS, and FTP) and patterns, making it directly applicable to contemporary communication network challenges. The 5G-NIDD dataset represents a dataset for network intrusion detection derived from a real 5G testing environment. The dataset encompasses distinctive attributes that are characteristics of 5G network traffic when compared with earlier datasets. The dataset was collected using a 5G test network (5 GTN) located in Oulu, Finland [83] with a carrier-grade testing environment [84].