## 6 Experimental Design and Results  
In this section, we present the results of our analysis, where various configurations were tested for each of the proposed methods. The selected hyper-parameters were chosen based on their optimal performance in terms of classification accuracy and computational efficiency. For SVM, we employed the Linear Kernel function to separate the data. This choice was motivated by its simplicity, efficiency, and effectiveness in finding an optimal solution for data separation. By projecting the data into a higher-dimensional space, the linear kernel function makes it easier for the SVM to identify and separate data points, thus enhancing classification performance. In the case of Decision Trees (DT) and Random Forests (RF), we utilized Gini's diversity index as the criterion for generating the trees. Gini's index measures the diversity of samples used in creating a decision tree. It calculates the probability of misclassifying a randomly chosen sample when using the decision tree. By minimizing the Gini index, we increase the diversity of the samples and reduce the probability of incorrect classification. This makes Gini's diversity index a valuable tool for evaluating the performance of DT and RF algorithms in intrusion detection systems. KNN (K-Nearest Neighbors) was configured with K-neighbors set to 5, and we employed the Cosine Distance as the distance metric. The use of the cosine distance in KNN models for intrusion detection systems offers several advantages. The cosine distance measures the similarity between two vectors, making it a suitable metric for comparing the similarity between intrusion patterns. In the case of Linear Discriminant Analysis (LDA), we utilized the Pseudo-linear Discriminant type. This approach involves the use of the pseudo-inverse of the covariance matrix rather than the linear covariance matrix. By employing kernel functions to project the data into a higher-dimensional space, the separability of the data is enhanced. Additionally, the pseudo-linear approach is computationally efficient and capable of handling large datasets, making it ideal for intrusion detection systems that require real-time processing of substantial amounts of data. Additionally, our approach allowed for the incorporation of non-linear relationships in the data, enhancing the accuracy and robustness of intrusion detection. Regarding the Artificial Neural Network (ANN) models, we employed different architectures for binary \begin{table}
\begin{tabular}{l c} \hline \hline \multicolumn{2}{c}{**CSE-CIC-IDS 2018**} \\ \hline
**Attack Type** & **Percent** \\ \hline _Bot_ & 10\% \\ \hline _DDoS attack HOIC_ & 10\% \\ \hline _DDoS attack LOIC HTTP_ & 10\% \\ \hline _DoS attack GoldenEye_ & 10\% \\ \hline _DoS attack Hulk_ & 10\% \\ \hline _DoS attack SlowHTTP Test_ & 10\% \\ \hline _DoS attack Slowloris_ & 10\% \\ \hline _FTP Brute Force_ & 10\% \\ \hline _Infiltration_ & 10\% \\ \hline _SSH Brute Force_ & 10\% \\ \hline
**Total** & **100\%** \\ \hline \hline \end{tabular}
\end{table} 
Table 14: Attack categories remained after CSE-CIC-IDS 2018 dataset balancing. and multi-class classification. In binary classification, we utilized two types of networks: ANN Single Layer (SL) and ANN Multi-layer (ML). The number of neurons in each layer was adjusted based on the dataset number of features. For the KDD 99 dataset, we used ANN SL with a single hidden layer consisting of 140 neurons. The ANN ML model comprised five hidden layers with 140, 280, 140, 60, and 30 neurons, respectively. Both ANNs employed the ReLU activation function, and the output layer contained 2 neurons with the Softmax activation function. In the UNSW-NB15 dataset, we implemented two approaches for binary classification. The first approach utilized ANN SL with a single hidden layer of 260 neurons and ReLU activation functions. The second approach involved a five-layer ANN with 260, 520, 260, 100, and 50 neurons in each respective layer.