## 4 Experiment and Results
### Multiclass Classification  
Following our initial experiments with binary classification to differentiate between legitimate and malicious traffic, we extended our analysis to a multiclass classification approach. This shift allowed us to evaluate how well the selected model can identify specific types of attacks, including brute force, DoS, flooding, malformed data, and SlowITe attacks. The significance of this extension is twofold. First, it provides a more granular understanding of the nature of the threats, enhancing the intrusion detection system's capabilities. Second, it can help in developing more targeted mitigation strategies. Hence, we have six classes in this case, as opposed to the two in the binary classification scenario. While most steps remained consistent with our binary classification approach, some adjustments were necessary for handling multiclass cases. In the multiclass classification approach, we initially used LabelEncoder to transform categorical labels into numerical values, making it easier to handle the labels computationally. Subsequently, we applied OneHotEncoder to the target variable. This encoding method converted the numerical labels into a binary matrix, facilitating the multiclass classification by ensuring that each class was represented correctly without implying any ordinal relationship. Moreover, as in the previous case, we employed GridSearchCV and Keras Tuner to optimize hyperparameters for our models. The identified best hyperparameters for the multiclass classification approach are summarized in Table 7.  
To accommodate the multiclass nature of the problem, the DNN architecture was modified to include an output layer with nodes equal to the number of classes, using the softmax activation function [53]. The softmax function maps output values to a [0,1] range, allowing them to be interpreted as probabilities. As discussed in [35], the softmax function is essentially an extension of the sigmoid function [48] for multiclass classification, determining the probability of each class simultaneously [53; 54]. Furthermore, we employed the Adam optimizer [48] with categorical_crossentropy loss, which is appropriate for multiclass classification tasks [49]. The performance metrics used in the binary classification case were adapted for the multiclass classification case. Therefore, the evaluation for multiclass classification included the following:  
1. Classification report: This includes accuracy, precision, recall, and F1-score. Table 8 summarizes the obtained results for these metrics. As previously defined, the \"Searching Time (s)\" reported in Table 8 refers to the computational time required by hyperparameter optimization procedures to identify the optimal hyperparameter combinations used for subsequent model training. \begin{table}
\begin{tabular}{l l} \hline \hline
**Algorithm** & **Identified Best Parameters (Based on the Defined Parameter Grid)** \\ \hline RF & bootstrap: True, max\_depth: 20, min\_samples\_leaf: 2, min\_samples\_split: 5, n\_estimators: 200 \\ LR & C: 1.0, max\_iter: 100, penalty: l2, solver: liblinear \\ DT & criterion: entropy, max\_depth: 10, min\_samples\_leaf: 1, \\  & min\_samples\_split: 10, splitter: best \\ GB & learning\_rate: 0.01, max\_depth: 7, min\_samples\_leaf: 10, \\  & min\_samples\_split: 2, n\_estimators: 300 \\ XGBoost & colsample\_bytree: 1.0, gamma: 0.1, learning\_rate: 0.1, max\_depth: 7, \\  & min\_child\_weight: 3, n\_estimators: 100, subsample: 0.8 \\ MLP & activation: tanh, alpha: 0.0001, hidden\_layer\_sizes: (100, 100), \\  & learning\_rate: constant, solver: adam \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Identified best hyperparameters (multiclass). - TP (XX): True positive for class X. - FP (XY): False positive, predicted as class Y but actual class is X. - FN (YX): False negative, actual class Y but predicted as class X. For the sake of brevity, we present Figure 5, the confusion matrix for the RF model. The confusion matrices for the other six models are provided in the Appendix A (see Figure A1).