# Explainable Lightweight Block Attention Module Framework for Network-Based IoT Attack Detection
## 4 Experimental Results
### Discussion
#### 4.2.2 Performance Evaluation on the CIC-IDS2017 Dataset  
Table 4 displays the suggested model's performance in multi-class classification on the CICIDS2017 dataset according to ACC, PRE, REC, and F1. The proposed method performed the best at detecting \"benign\" traffic (detection ACC of 99.97%) and the worst at detecting \"SQL injection\" traffic (detection ACC of 97.98%). The \"SQL injection\" data were scarce in the whole dataset, which caused the performance of the classifier to be poor. Moreover, the behavior pattern of a \"bot\" attack is similar to that of regular network traffic, making it harder for the proposed approach to recognize the attacks accurately, thus leading to average performance. Compared with heartbleed and SQL injection attacks, the brute force attack was more accurately predicted. Figure 6 displays a visual depiction of Table 4.  
Regarding other performance scores, brute force and DDoS Hulk achieved similar PRE (99.67%), REC (99.65%), and F1 (99.67%) results. This demonstrated that the proposed classifier still displayed asymmetric behavior with regard to traffic classifications in this arrangement. Furthermore, ACC and REC rates are critical for assessing the classifier's performance for every attack. According to the statistics, a class with low accuracy has a lot of false positives, which implies that 'benign' classes are unnecessarily marked as assaults. Additionally, a model with low recall may ignore actual intrusion. Therefore, to ensure that the model performs optimally, ACC and REC values must be high enough. As stated in Figure 6, the proposed model achieved superior values for all the parameters that describe the method's efficiency for multi-class categorization. Figure 5: Accuracy comparison of the proposed approach on Bot-IoT dataset. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Techniques** & **Precision** & **Recall** & **F1** & **Accuracy** \\ \hline SVM [31] & 89.60 & 89.35 & 89.34 & 89.35 \\ \hline XGBOST [61] & 99.38 & 99.57 & 99.47 & 98.96 \\ \hline KNN [62] & 99.04 & 99.03 & 99.04 & 99.03 \\ \hline C4.5 [63] & - & - & - & 92 \\ \hline
**Proposed** & **99.46** & **99.61** & **99.49** & **99.38** \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Comparison of the proposed approach on Bot-IoT dataset. To show the effectiveness of the proposed approach, Table 5 compares the proposed approach's results with those of existing techniques on the CICIDS2017 dataset. Our suggested methodology produced better performance when compared to existing techniques. In terms of F1, the deep neural network (DNN) and recurrent neural network (RNN) achieved similar values. Compared to all other techniques, Adaboost's performance in terms of DDoS attack classification was substandard. However, the REC (100%) value of this technique was higher than that of all other approaches, which means this technique provided only a few false negatives. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Techniques** & **Precision** & **Recall** & **F1** & **Accuracy** \\ \hline
**Benign** & 99.95 & 99.93 & 99.95 & 99.97 \\ \hline
**DDoS** & 99.89 & 99.85 & 99.87 & 99.92 \\ \hline
**Infiltration** & 99.59 & 99.57 & 99.58 & 99.63 \\ \hline
**Portscan** & 99.87 & 99.85 & 99.86 & 99.92 \\ \hline
**Bot attack** & 98.85 & 98.81 & 98.83 & 98.89 \\ \hline
**Pataor-FTP** & 99.89 & 99.86 & 99.87 & 99.95 \\ \hline
**Pataor SSH** & 99.23 & 99.21 & 99.22 & 99.27 \\ \hline
**Brute force** & 99.67 & 99.65 & 99.66 & 99.71 \\ \hline
**XSS** & 99.17 & 99.14 & 99.16 & 99.33 \\ \hline
**SQL injection** & 97.56 & 97.52 & 97.54 & 97.98 \\ \hline
**DDOs GoldenEye** & 98.92 & 98.89 & 98.91 & 98.96 \\ \hline
**DDOS Hulk** & 99.67 & 99.65 & 99.66 & 99.73 \\ \hline
**DDOS slowhttptest** & 98.68 & 98.66 & 98.67 & 98.71 \\ \hline
**DDOS-slowloris** & 98.83 & 98.8 & 98.82 & 98.86 \\ \hline
**Heartbeed** & 98.08 & 97.99 & 98.04 & 98.12 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Multi-class classification on the CIC-IDS2017 dataset. Figure 6: Multi-class classification on the CICIDS2017 dataset.