# A Novel Deep Learning Framework for Intrusion Detection Systems in Wireless Network
## 6 Testing the HRC Strategy on Another Dataset  
We test our proposed HRC strategy on another dataset to more generally evaluate the applicability of the proposed strategy in another different situation.  
The dataset we use here is NSL-KDD, which is the latest version of the KDD cup99 dataset family [46; 72]. This dataset contains 22 instances of training intrusion attacks and 41 features, with 21 features related to the connection and 19 features detailing connections within the same host. We proceed to extract the \"normal\" category alongside seven types of attack, including Neptune, IP sweep, port sweep, smurf, back, and teardrop, to experiment with the proposed HRC strategy.  
The process is the same as the process we used for the AWID3 dataset; we chose the best possible features from the data to reduce the computation time and the overfitting effect using the Extra Trees Classifier. Figures 22 and 23 show the data's most significant features according to the Extra Trees Classifier and the comparison between each category's number of samples in the training set:  
Figure 22: Important features according to Extra Trees Classifier.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Type of Traffic** & **Precision** & **Recall** & **F1 Score** & **Support** \\ \hline Normal & 1.00 & 1.00 & 1.00 & 322,591 \\ \hline Website spoofing & 0.99 & 0.88 & 0.93 & 24,442 \\ \hline Evil Twin & 0.00 & 0.00 & 0.00 & 0 \\ \hline Botnet & 0.00 & 0.00 & 0.00 & 8 \\ \hline Malware & 0.88 & 0.98 & 0.93 & 21,540 \\ \hline
**Accuracy** & – & – & 0.99 & 368,581 \\ \hline
**Macro average** & 0.57 & 0.57 & 0.57 & 368,581 \\ \hline
**Weighted** & 0.99 & 0.99 & 0.99 & 368,581 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Classification report of the histogram gradient boosting approach.  
The training and validation processes of our Con1D-LSTM and CNN1D models in regression and classification problems are shown in Figures 24 and 25, respectively.  
Figure 23: Number of each category’s samples in the training set.  
Figure 24: The training results of the regression model on the NSL-KDD training dataset.  
Figure 25: The training results of the classification model on the NSL-KDD training dataset.  
We apply the full strategy to the testing data and present the confusion matrix and classification report in Figure 26 and Table 6  
Based on the experimental results, the HRC strategy also achieves good performance in the case of different datasets with more imbalanced categories with an accuracy of approximately 0.97. The two fewest in the number of sample attacks are Back and Teardrop, reaching the high F1 score of about 0.99 and 1.00. The category with the lowest F1 is Port Sweep, with a score of 0.78, while having double the number of data samples compared to the former two. We think the Port SWeep shares some similar features to Neptune or Other attacks that made the models in the strategy have difficulty distinguishing between them during training. This score is not low, relatively, but actually still higher than the Botnet attack in the case of the AWID3 dataset. Overall, it is better than the result of the AWID3 dataset. We personally think that the NSL-KDD dataset has cleaner IP package data and a clearer pattern of the IP traffic flow that helps the models in our proposed strategy capture the information better.