## 4 Evaluation
### Comparison with Baseline Architectures  
For further validation, the detection performance of our contextual bandit-based reinforcement learning approach was benchmarked against several baseline configurations, as summarized in Table 4. Our contextual bandit-based reinforcement learning approach can be compared to modern cloud-based phishing and malware detection services, such as Microsoft Defender, which incorporate a local, low-cost detection mechanism and an auxiliary cloud-based inference engine that is triggered only if the host-based component is unable to yield a definitive decision. Analogous configurations have thus been adopted as baseline architectures for evaluating our approach.  
In Table 4, the \"Large\" model trains on all features available in subset A and subset B of the CSE-CIC-IDS2018 dataset, whereas the \"Light\" variants, L1 and L2, operate using only subsets of these features (see Section 4.2 for details). The \"Stacked\" model combines L1 and L2 by averaging their predictive probabilities, with a cost similar to that of the Large model. We compared these approaches with two configurations in our contextual bandit-based reinforcement learning approach, selected for having either the best performance or the lowest triage rate, according to the results in Tables 2 and 3.  
As expected, the Large and Stacked models yielded the highest detection rates overall. Similarly, L2 outperformed L1 due to its utilization of more complex and resource-intensive features. Although the variants of our approach demonstrate minor reductions in detection metrics, they compensate with substantial cost savings. Among the strategies in our contextual bandit-based reinforcement learning approach, those employing UCB and Thompson sampling often achieve either superior performance or more pronounced cost reductions, qualifying them for inclusion in Table 3.  
Focusing on the Bell dataset with the neural network (NN) model, we observed that \(log(k)\) (UCB) and \(\rho^{d_{P,A,t}}\) (Thompson) differ by only about 1% in performance, while \(log(k)\) achieves a 50.4% cost reduction compared to \(\rho^{d_{P,A,t}}\). Against the Large model, both \(log(k)\) and \(\rho^{d_{P,A,t}}\) exhibit an approximately 1% decrease in accuracy and a reduction in precision of approximately 4% and 3%, respectively. Interestingly, the L2 model surpasses the Large model in terms of accuracy, with a 7% improvement, reaching 95%. When using Random Forests on the Bell dataset, \(log(k)\) (UCBe) achieves a 42.8% higher cost saving. Incomparison, 0.9 (Thompson) trails by only 1% in terms of accuracy (88% versus 89%), while the Large model attains the best accuracy at 96%. Thus, employing our approach in these instances trades an approximate 8% decrease in detection performance for noteworthy cost benefits.  
For subset B of the CSE-CIC-IDS2018 dataset, both the RF and NN models demonstrate robust detection capabilities, likely due to the dataset's nature. With NN, two configurations in our contextual bandit-based reinforcement learning approach (\(log(k)\) with [PERSON] and \(log(k)\) with UCB) deliver nearly identical detection outcomes, although \(log(k)\) (UCB) offers a 74.5% greater cost reduction than \(log(k)\) (Thompson). Similarly, when RF is applied, \(log(k)\) (UCBe) achieves both top-tier detection performance and cost savings, exceeding the Stacked model and performing comparably to the Large model.