## 4 Evaluation
### Cost-Saving Results  
This section examines the extent of cost reductions achieved by each reward policy. Specifically, we concentrate on the five most effective reward policies, applying them to the two datasets and the two model configurations introduced in Section 4.2. A concise summary of these findings is provided in Table 2.  
Overall, the highest-performing reward policies yield notably reduced triage frequencies. In particular, the \(log(k)\) policy stands out, as it consistently records the lowest triage rate across both datasets, surpassing policies that incorporate alternative exploration mechanisms. This indicates that the \(log(k)\) policy fosters stable, cost-effective operation regardless of the underlying dataset or detection model.  
Within this study, \"cost\" corresponds to the proportion of instances processed by the more resource-intensive layer. Hence, cost savings can be quantified as follows:  
\[\frac{totalobservations-totaltriaged}{totalobservations}\]  
When applied to subset A of the CSE-CIC-IDS2018 dataset using the Random Forest model, our contextual bandit-based reinforcement learning approach incurs only 5.69% of the full operational cost (734.78 out of 12,904), thus achieving a 94.31% reduction. In comparison, the neural network-based approach involves 13.16% of the full cost (1697.62 out of 12,904), translating to an 86.84% cost-saving advantage over a scenario utilizing all detection resources. A similar trend emerges with subset B of the CSE-CIC-IDS2018 dataset, where the neural network configuration expends 23.91% (3834.04 out of 16,032) for a 76.08% saving, while the Random Forest variant uses 11.99% (1922.68 out of 16,032), yielding an 88% reduction.  
Among the four evaluated selection functions, those employing UCB, UCBe, and Thompson sampling achieve greater cost savings than the Softmax-based strategies. The UCB variants, in particular, aggressively reduce the volume of triaged items, although the relative effectiveness of UCB versus UCBe varies depending on the dataset. Softmax, on the other hand, offers a prudent compromise, balancing cost reduction and detection quality.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset (Subset)** & **Detection Model** & **Reward Description** & **Selection Strategy** &
\begin{tabular}{c} **Triage Rate** \\ **(Requests)** \\ \end{tabular} \\ \hline \multirow{8}{*}{Subset A} & \multirow{4}{*}{Neural Network} & \(log(k)\) & UCB & 1350.62 \\  & & \(log(k)\) & Thompson & 2100.34 \\  & & \(log(k)\) & UCBE & 2156.18 \\  & & \(\rho^{\mathcal{A}_{P,A}}\) & Thompson & 3000.12 \\  & & 0.9 & Thompson & 3200.78 \\ \cline{2-5}  & & \(log(k)\) & UCBE & 700.42 \\  & & \(log(k)\) & UCB & 800.55 \\  & & \(log(k)\) & [PERSON] & 1250.34 \\  & & \(\rho^{\mathcal{A}_{P,A}}\) & [PERSON] & 1400.67 \\  & & 0.9 & [PERSON] & 1550.12 \\ \hline \multirow{8}{*}{Subset B} & \multirow{4}{*}{Neural Network} & \(log(k)\) & UCB & 3700.18 \\  & & \(log(k)\) & UCBE & 4000.25 \\  & & \(log(k)\) & [PERSON] & 4500.11 \\  & & \(\rho^{\mathcal{A}_{P,A}}\) & [PERSON] & 5000.32 \\ \cline{1-1} \cline{2-5}  & & \(log(k)\) & UCBE & 1900.62 \\  & & \(log(k)\) & UCB & 2000.1 \\  & & \(log(k)\) & [PERSON] & 2800.4 \\  & & \(\rho^{\mathcal{A}_{P,A}}\) & [PERSON] & 3200.18 \\  & & \(\rho^{\mathcal{A}_{P,A}}\) & [PERSON] & 3500.22 \\ \hline \hline \end{tabular}  
* Reward description note: The ”Reward Description” column specifies the reward policies used in the experiments, such as ”\(log(k)\) or “\(\mathcal{A}_{P,A}\),”, which define the criteria for reward allocation in the reinforcement learning framework.  
\end{table}
Table 2: Triage rates across different reward policies and selection strategies for neural network and Random Forest models on subsets A and B.