## 3 Methodology
### Rlfoula Framework Description
#### 3.2.3 Employing Functional Agents in RL
The aggregated metrics at the bottom of the table provide an overview of the overall performance. The accuracy of the model is 0.9981, indicating a high overall accuracy in classifying the attack types. The macro average and weighted average metrics calculate the average precision, recall, and F1 score across all attack types. The macro average gives equal weight to each attack type, while the weighted average considers the support (number of instances) of each attack type when calculating the average. Table 4 offers valuable insights into the performance of the IDS model for different attack types, enabling a comprehensive assessment of its effectiveness in detecting and classifying network intrusions. The overall accuracy achieved by the RLFOUA framework on the NSL-KDD dataset was 0.9981, demonstrating its effectiveness in accurately classifying attack types. The macro average metrics, with precision, recall, and F1 score values of approximately 0.81, reflect an acceptable overall performance across all attack types, considering their varying support and frequency in the dataset. Upon examining the results for different attack types in Table 4, several noteworthy trends and variations emerge. The framework demonstrates exceptional proficiency in detecting certain types of attacks, such as \"neptune\", \"guess_passwd\", \"multihop\", and \"pod\", achieving perfect precision, recall, and F1 score values. These results suggest that the RLFOUA framework, in tandem with the TFRSMOTE algorithm, excels in accurately identifying these specific attack categories. However, it is important to note that for less common attack types, like \"ftp_write\", \"loadmodule\", \"rootkit\", and \"waremaster\", the performance metrics indicate room for improvement. The precision and recall values for these categories are relatively lower, indicating a potential area for further refinement in the framework's ability to discern these less-frequent attack types. These observations highlight the framework's strengths in handling prevalent attack categories, while also identifying potential areas for enhancement, particularly in the context of rare or infrequent attacks. This balanced evaluation underscores the framework's potential to contribute significantly to the field of intrusion detection and bolster cybersecurity measures. ## 5 Discussion

In this paper, we introduce RLFOUA, an RL framework, which is seamlessly integrated with a novel resampling algorithm known as TFRSMOTE. Our comprehensive approach showcases remarkable performance across two well-known IDS datasets: CSE-CIC-ID2018 \begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**Attack Type** & **Precision** & **Recall** & **F1 Score** & **Support** & **Frequency** \\ \hline Loadmodule & 0 & 0 & 0 & 1 & 9 \\ Multihop & 1 & 1 & 1 & 1 & 7 \\ Neptune & 1 & 1 & 1 & 4147 & 41,214 \\ Nmap & 0.986 & 0.986 & 0.986 & 143 & 1493 \\ Normal & 0.9976 & 0.9996 & 0.9986 & 6713 & 67,343 \\ Pod & 1 & 1 & 1 & 18 & 201 \\ Portsweep & 0.9963 & 1 & 0.9982 & 271 & 2931 \\ Rootkit & 0 & 0 & 0 & 2 & 10 \\ Satan & 1 & 0.9864 & 0.9931 & 367 & 3633 \\ Smurf & 1 & 1 & 1 & 283 & 2646 \\ Teardrop & 1 & 1 & 1 & 95 & 892 \\ Wareclient & 0.978 & 0.9271 & 0.9519 & 96 & 890 \\ Waremaster & 1 & 1 & 1 & 1 & 20 \\ Accuracy & & & 0.9981 & 12,597 & \\ Macro Avg & 0.8133 & 0.8255 & 0.8144 & 12,597 & \\ Weighted & 0.9978 & 0.9981 & 0.9979 & 12,597 & \\ Avg & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 4: _Cont._and NSL-KDD. The former dataset, CSE-CIC-ID2018, is structured as a binary classification task involving benign and infiltration instances. On the other hand, NSL-KDD encompasses a diverse spectrum of attack types, including those occurring at a frequency of fewer than ten instances within the dataset. While these datasets are widely acknowledged in the IDSs field, they offer distinct features and encompass a variety of attack characteristics.