## 4 Model Evaluations
### Model Evaluations on Combination of CNN with LSTM
Furthermore, the absence of hyperparameter tuning and the meticulous evaluation of the model are imperative in order to guarantee the optimal performance of the hybrid model. This is due to the equilibrium of the data. The analysis exhibits a notable level of performance observation (see Table 8). The potential cause of this improved performance may be linked to the inherent temporal characteristics of the data. Hence, a substantial quantity of precise observations was made, suggesting that the forecasting of feature alterations can be efficiently anticipated through the utilization of a combined hybrid methodology. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **Acc** & **Recall** & **Precision** & **FPR** & **F1-Score** \\ \hline Normal & 99.71 & 99.24 & 99.53 & 0.13 & 98.54 \\ \hline Flow Duration Modification & 99.26 & 97.82 & 99.34 & 0.17 & 96.35 \\ \hline Forward packet Modification & 97.93 & 98.76 & 97.46 & 0.11 & 97.58 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Model performance training with CNN + LSTM on CICIDS2017 dataset. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **Acc** & **Recall** & **Precision** & **FPR** & **F1-Score** \\ \hline Normal & 97.35 & 94.68 & 97.25 & 0.14 & 99.28 \\ \hline Flow Duration Modification & 99.58 & 99.27 & 99.49 & 0.12 & 97.89 \\ \hline Forward Packet Modification & 99.63 & 99.47 & 99.92 & 0 & 98.99 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Model performance training with CNN + LSTM on store-and-forward dataset. The model utilizing the combination of CNN and LSTM on the store-and-forward dataset demonstrates superior performance accuracy in predicting forward packet modification. It exhibits the highest ACC value and the lowest FPR value among the compared models. The input for forward packet modification consists of unprocessed network traffic data. The model associated with flow duration modification does not incorporate any distinct feature extraction mechanism. Instead, the feature extraction time is included within the overall training and testing duration. The conventional machine learning algorithm does not take into account the extraction or processing time of data, thus making it impossible to directly compare the time consumption of the different algorithms in this study. The model's training time and testing time were both less than 200 s and 150 s, respectively. This study posits that modifying the flow duration yields optimal detection effects within the same time frame as the traditional algorithm. It is crucial to comprehend the degree of accuracy and efficiency with which the analysis was conducted, while also considering any potential uncertainties that may have arisen. This understanding is vital for the interpretation of the model's performance during the training of a convolutional neural network (CNN) combined with long short-term memory (LSTM) on the store-and-forward dataset, utilizing the receiver operating characteristic (ROC) methodology. The ROC curves indicate that the experiment was highly successful, as evidenced by the curve approaching unity in Figure 4. Consequently, the CNN + LSTM model demonstrates a propensity for attaining nearly flawless outcomes in prediction tasks involving store-and-forward datasets. Figure 3: The model performance with CNN + LSTM on CICIDS2017 dataset using ROC.