## 4 Results and Discussion
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Class** & **Accuracy** & **Precision** & **Recall** & **F-Score** & **AUC Score** \\ \hline TRPH (30\%) & & & & & \\ Botnet & 98.05 & 95.85 & 98.05 & 96.94 & 98.72 \\ Normal & 99.40 & 99.72 & 99.40 & 99.56 & 98.72 \\ Average & 98.72 & 97.79 & 98.72 & 98.25  
different data splits, indicating its robustness and generalizability. These detailed performance metrics provide a clearer understanding of the model's strengths, as shown in Table 3.  
Table 4 and Figure 3 present the detailed results of the anomaly detection capability test using a 70:30 split of the TRPM/TSPH data. The GA-HDLAD method demonstrates its effectiveness in identifying both normal and botnet samples. With 70% of the TRPM data, the approach achieves an average accuracy of 99.03%, precision of 96.84%, recall of 98.80%, F-score of 97.80%, and AUC score of 98.82%. This high accuracy indicates that the model performs well in classifying both normal and botnet traffic, showing minimal misclassification. For the 30% TSPH data, the model's results show an even higher accuracy of 99.06%, precision of 96.99%, recall of 98.90%, F-score of 97.92%, and AUC score of 98.90%, further validating the robustness of the GA-HDLAD approach across different dataset splits. These results, presented in Table 4, highlight the model's strong performance across multiple key metrics, clearly demonstrating its reliability in detecting anomalies in IoT traffic. Following this, TES and TRA accuracy curves were drawn to establish how well the GA-HDLAD algorithm performs at 70:30 of TRPM/TSPH (Figure 4). The resulting curves illustrate the algorithm's efficacy at numerous epochs and provide important information about the learning tasks and generalization abilities of the GA-HDLAD approach. As the epochs increase, the TES and TRA accuracy curves are enhanced. This is an indicator  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Class** & **Accuracy** & **Precision** & **Recall** & **F-Score** & **AUC Score** \\ \hline TRPH (60\%) & & & & & \\ Botnet & 99.03 & 93.92 & 98.55 & 96.18 & 98.82 \\ Normal & 99.03 & 99.75 & 99.10 & 99.43 & 98.82 \\ Average & 99.03 & 96.84 & 98.80 & 97.80 &  
that the GA-HDLAD technique achieves greater TES accuracy, demonstrating its ability to identify patterns in TRA and TES data. The TES and TRA loss values at 70:30 of the TRPM/TSPH across different epochs are shown in Figure 5. The TRA loss indicates a reduction in the model loss, which can be used to modify the weight to minimize the classifier error in the TES and TRA data. The figure shows that the TRA and TES losses are steadily reduced, and also indicates that the GA-HDLAD algorithm is able to effectively learn the patterns in the TES and TRA data. The method is able to adapt the parameters to reduce the variance between the predictions and actual training labels. Figure 4: Performance curve of the GA-HDLAD model showing accuracy. Figure 3: Average performance of GA-HDLAD methodology with 60:40 split. Figure 6 presents the precision-recall (PR) analysis of the GA-HDLAD algorithm using the 70:30 TRPM/TSPH split. The curve demonstrates high precision and recall values for both botnet and normal traffic classes, indicating the model's strong capability to accurately identify true positives while maintaining a low rate of false positives. The confidence intervals (CIs) around the PR curves further illustrate the model's consistency across different samples, with both the botnet and normal classes achieving near-perfect precision and recall. The high PR values confirm the model's ability to accurately detect botnet traffic with minimal false positives. The tight CIs reflect the stability of the GA-HDLAD method, reinforcing its effectiveness in maintaining high precision and recall for reliable IoT anomaly detection. Figure 7 shows the ROC analysis of the GA-HDLAD approach at a split of 70:30 for TRPM/TSPH, indicating its ability to discern between classes.