## 3 Design and Implementation of the Proposed CBC Method
### Results and Analysis of the Proposed CBC Method  
Accuracy, precision, detection rate, and F1 score are among the evaluation criteria used to assess the effectiveness of the suggested CBC technique. Machine learning algorithms are used to perform the comparison analysis: XGBoost, AdaBoost, KNN, and Random Forest. This section discusses the performance of the proposed CBC method. The evaluation of the proposed CBC approach is designed for two-class and eight-class classification using eight and two clusters, respectively. Table 3 shows the results of eight-class classification represented in two clusters. Table 4 shows the results of two-class classification mapped to eight clusters. Each cluster is trained on machine learning models, including XGBoost, AdaBoost, KNN, and Random Forest. The output of each model from each cluster is aggregated to observe the system's overall performance. Table 5 shows the unified results of eight-class classification with two clusters. KNN outperforms other methods, with an accuracy of 0.88. Table 6 reports the collective performance of two-class classification with eight clusters. In the two-class classification, Random Forest performs better than other classifiers, yet it does not exhibit this advantage in the eight-class scenario. In the two-class classification scenario, the random forest classifier outperforms other models, highlighting its ability to handle binary classification problems effectively. The fact that its performance in the eight-class scenario was not as good does not undermine the effectiveness of the cluster-based classification (CBC) approach. The results show the capability of the CBC approach, which allows for the use of multiple classifiers tailored to the complexity of each cluster. The CBC method ensures that even when a single classifier, like Random Forest, does not dominate across all classes, the overall system maintains high accuracy and \begin{table}
\begin{tabular}{l l} \hline \hline
**Labels** & **Subtypes** \\ \hline
**Spoofing** & TCP flood \\ \hline  & DNS spoofing \\ \hline  & Arp spoofing \\ \hline
**DoS** & SYN flood \\ \hline  & UDP flood \\ \hline  & HTTP flood \\ \hline  & TCP flood \\ \hline
**Recon** & Host discovery \\ \hline  & Ping sweep \\ \hline  & Vulnerability scan \\ \hline  & OS scan \\ \hline  & Port scan \\ \hline
**Web-based** & Command injection \\ \hline  & Uploading attack \\ \hline  & SQL injection \\ \hline  & Backdoor malware \\ \hline  & Browser hijacking \\ \hline  & XSS \\ \hline
**Mirai** & Greeth flood \\ \hline  & UDPPlain \\ \hline  & GREIP flood \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _Cont._robustness by distributing the classification task across optimized clusters. This modularity enhances detection precision and better handles diverse and complex attack types. The eight-class classification scenario did not display any signs of unbalanced classes or any specific problems in this category. Random Forest achieved the highest accuracy of 0.9, higher than that achieved for eight-class classification. Figures 8 and 9 illustrate present bar graphs for eight-class and two-class CBC, respectively.