## 4 Experimental Simulations
### Experimental Results and Analysis
#### 4.3.6 Comparison Experiments of Run-Time Performance  
To evaluate the run-time performance of the proposed model, this section sets up comparison experiments. Under the same experimental conditions, experiments are conducted for each of the following five scenarios to compare their training and prediction time and classification accuracy. These five scenarios are described as follows: (1) \"Before RFP\" means that the data is only sampled using the ADRDB algorithm during the data pre-processing stage, and then the data is converted into grayscale maps for input into the classification model; (2) \"Before RFP\" means that the data is not sampled using the ADRDB algorithm in the pre-processing stage, and the normalized data is only selected using the RFP algorithm, and then the data is converted into a grayscale map for input into the classification model; (3) \"CNN\" means that the data is preprocessed using the method described in Section 3.1, and then converted to grayscale maps for input into the classification model, which uses only the CNN structure; (4) \"GRU\" means that the data is preprocessed using the method described in Section 3.1, and then converted to grayscale maps for input into the classification model, which uses only the GRU structure; (5) \"Proposed Model\" indicates that the data are pre-processed using the method described in Section 3.1, and then the data are converted into grayscale maps for input into the proposed classification model. Besides, \"Train\" indicates the time taken to train the model for 200 epochs. The obtained experimental results are shown in Table 12. The bold text indicates the evaluation indicators of the proposed model.  
From Table 12, the model proposed in this paper consumes more time than \"CNN\", \"GRU\", \"Before ADRDB\" and less time than \"Before RFP\". The main reasons are as follows: The ADRDB algorithm generates new samples after the sampling is completed, resulting in more samples being used for training and testing, and thus takes more time. The RFP algorithm results in a decrease in the number of features in the samples after the feature selection is completed, and thus takes less time. When using a single CNN or GRU structure, the number of model parameters is smaller and thus the time spent is relatively less. The proposed model in this paper consumes relatively more time, however the model accuracy is greatly improved.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Dataset**} & \multirow{2}{*}{**Pooling Method**} & \multicolumn{5}{c}{**Evaluation Indicators (\%)**} \\ \cline{3-6}  & & **Accuracy** & **Precision** & **Recall** & **F1-Score** \\ \hline \multirow{3}{*}{NSL-KDD} & Averagepooling & 98.96 & 98.95 & 98.96 & 98.94 \\  & Maxpooling & 98.42 & 98.38 & 98.42 & 98.39 \\  & Averagepooling + Maxpooling & **99.69** & **99.65** & **99.69** & **99.70** \\  & Averagepooling & 83.13 & 84.97 & 83.13 & 84.03 \\ \multirow{3}{*}{UNSW\_NB15} & Maxpooling & 83.25 & 84.96 & 83.25 & 84.10 \\  & Averagepooling + Maxpooling & **86.25** & **86.92** & **86.25** & **86.59** \\  & Averagepooling & 98.55 & 98.64 & 98.55 & 96.37 \\ \multirow{3}{*}{CIC-IDS2017} & Maxpooling & 93.85 & 94.52 & 93.85 & 93.89 \\  & Averagepooling + Maxpooling & **99.65** & **99.63** & **99.65** & **99.64** \\ \hline \hline \end{tabular}
\end{table}
Table 11: Comparison of different pooling methods.