## 5 Experiments
### Harmful Traffic Classes Detection
In IDS18, attacks are more varied, including different types of flooding (e.g., HTTP, SYN flood) that aim to disrupt services, targeting more modern network environments. BoT attacks focus on disrupting IoT devices' functionality and exploiting IoT ecosystems' limited resources, with traffic aimed at overwhelming low-power devices. Finally, ToN attacks target IoT devices and traditional networks, showcasing resource exhaustion in IoT environments while illustrating cloud-based and industrial infrastructure vulnerabilities. Another frequent class is the Distributed Denial of Service (\(DDoS\)) class in three datasets: BoT, ToN, and IDS18. Here also, BoT keeps most of the samples belonging to this class. Also, careful analysis, following that performed in the \(DoS\) class (see Figure 3,  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Class** & **Train** & **Test** & **A** & **P** & **R** & **F1** & **FNR** & **FPR** \\ \hline Do & BoT & BoT & 0.986 & 0.984 & 0.984 & 0.984 & 0.017 & 0.013 \\ Do & BoT & ToN & 0.954 & 0.000 & 0.000 & 0.000 & 1.000 & 0.004 \\ Do & BoT & NB15 & 0.937 & 0.024 & 0.072 & 0.019 & 0.928 & 0.061 \\ Do & BoT & IDS18 & 0.972 & 0.003 & 0.000 & 0.000 & 1.000 & 0.003 \\ \hline Do & ToN & BoT & 0.559 & 0.000 & 0.000 & 0.000 & 1.000 & 0.000 \\ Do & ToN & ToN & 0.990 & 0.884 & 0.884 & 0.884 & 0.116 & 0.005 \\ Do & ToN & NB15 & 0.993 & 0.000 & 0.000 & 0.000 & 1.000 & 0.005 \\ Do & ToN & IDS18 & 0.946 & 0.000 & 0.000 & 0.000 & 1.000 & 0.030 \\ \hline Do & NB15 & BoT & 0.558 & 0.002 & 0.000 & 0.000 & 1.000 & 0.000 \\ Do & NB15 & ToN & 0.957 & 0.150 & 0.007 & 0.013 & 0.993 & 0.002 \\ Do & NB15 & NB15 & 0.997 & 0.352 & 0.332 & 0.341 & 0.669 & 0.002 \\ Do & NB15 & IDS18 & 0.960 & 0.000 & 0.000 & 0.000 & 1.000 & 0.015 \\ \hline Do & IDS18 & BoT & 0.559 & 0.185 & 0.000 & 0.000 & 1.000 & 0.000 \\ Do & IDS18 & ToN & 0.944 & 0.000 & 0.000 & 0.000 & 1.000 & 0.014 \\ Do & IDS18 & NB15 & 0.997 & 0.000 & 0.000 & 0.000 & 1.000 & 0.000 \\ Do & IDS18 & IDS18 & 1.000 & 1.000 & 1.000 & 1.000 & 0.000 & 0.000 \\ \hline Do & All & BoT & 0.986 & 0.984 & 0.984 & 0.984 & 0.017 & 0.013 \\ Do & All & ToN & 0.990 & 0.886 & 0.863 & 0.874 & 0.137 & 0.005 \\ Do & All & NB15 & 0.997 & 0.345 & 0.319 & 0.331 & 0.682 & 0.002 \\ Do & All & IDS18 & 1.000 & 0.962 & 1.000 & 0.980 & 0.000 & 0.002 \\ \hline DD & BoT & BoT & 0.995 & 0.994 & 0.994 & 0.994 & 0.006 & 0.006 \\ DD & BoT & ToN & 0.880 & 0.000 & 0.000 & 0.000 & 1.000 & 0.000 \\ DD & BoT & IDS18 & 0.927 & 0.814 & 0.001 & 0.003 & 0.999 & 0.000 \\ \hline DD & ToN & BoT & 0.514 & 0.000 & 0.000 & 0.000 & 1.000 & 0.001 \\ DD & ToN & ToN & 0.991 & 0.952 & 0.975 & 0.963 & 0.025 & 0.007 \\ DD & ToN & IDS18 & 0.924 & 0.000 & 0.000 & 0.000 & 1.000 & 0.003 \\ \hline DD & IDS18 & BoT & 0.514 & 0.000 & 0.000 & 0.000 & 1.000 & 0.000 \\ DD & IDS18 & ToN & 0.880 & 0.238 & 0.000 & 0.001 & 1.000 & 0.000 \\ DD & IDS18 & IDS18 & 1.000 & 0.998 & 1.000 & 0.999 & 0.000 & 0.000 \\ \hline DD & All & BoT & 0.994 & 0.994 & 0.994 & 0.994 & 0.006 & 0.006 \\ DD & All & ToN & 0.991 & 0.952 & 0.975 & 0.963 & 0.025 & 0.007 \\ DD & All & IDS18 & 1.000 & 0.997 & 1.000 & 0.999 & 0.000 & 0.000 \\ \hline Ba & ToN & ToN & 1.000 & 0.994 & 0.992 & 0.993 & 0.008 & 0.000 \\ Ba & ToN & NB15 & 0.999 & 0.000 & 0.000 & 0.000 & 1.000 & 0.000 \\ \hline Ba & NB15 & ToN & 0.999 & 0.000 & 0.000 & 0.000 & 1.000 & 0.000 \\ Ba & NB15 & NB15 & 0.998 & 0.150 & 0.158 & 0.154 & 0.842 & 0.001 \\ \hline Ba & All & ToN & 1.000 & 0.999 & 0.987 &  
right, for t-SNE visualization) leads to the conclusion that the level of generalization of this class is extremely low--measures for all but own combination of datasets are close to 0, while FNR error rates--close to 1. The main differences lie in the attack targets: IDS18 focuses on traditional networks, while BoT and ToN deal with IoT environments, with ToN, also incorporating industrial and cloud systems in its scope. In IDS18, attacks involve large-scale, distributed attacks using botnets targeting traditional network services.