## 5 Experimental Results
### Results of the Proposed Flow-Level IDS  
Similarly, we conduct preprocessing on DDoS2019 at first. After transformation and normalization, the dimension of the state vector is 97. The structure of the stacked autoencoder is shown in Table 7. The dimension of the input layer, hidden layer and latent space is 97, 60, 25, respectively. The dimension of the fully connected layer is eight, equal to the number of classes. Figure 8 shows the performance of the stacked autoencoder, which is excellent on DDoS2019.  
In the first stage, we explore the influence of \(\varepsilon\) and \(\gamma\) when designing the agent and the sample agent. We also fix the length of the episode as 512. The experiment results are shown in Figures 9 and 10. We create a search space (0, 0.2) for both \(\varepsilon\) and \(\gamma\).  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Traffic** & **Accuracy** & **Precision** & **Recall** & **F1-Score** \\ \hline Normal & & 88.81\% & 93.64\% & 91.16\% \\ PortMap & & 86.83\% & 91.38\% & 89.05\% \\ NetBIOS & & 84.62\% & 90.69\% & 87.55\% \\ LDAO & & 82.36\% & 88.31\% & 85.23\% \\ MSSQL & 84.27\% & 88.24\% & 92.14\% & 90.14\% \\ UDP & & 83.55\% & 89.40\% & 86.38\% \\ UDP-Lag & & 82.07\% & 87.92\% & 84.90\% \\ SYN & & 84.67\% & 89.57\% & 87.05\% \\
**Anomaly** & & 81.12\% & 71.05\% & 75.71\% \\ \hline \hline \end{tabular}
\end{table}
Table 13: Test results of DQN-1D-CNN with discount value \(\gamma\) = 0.1 and \(\lambda\) = 0.7. The averaged computation time for detection is **0.143 s**.  
Figure 8: Performances of stacked autoencoder on DDoS2019.  
From the plots, we find that despite some anomaly pairs generating worse performances, most pairs associated with relatively small \(\varepsilon\) and \(\gamma\) can reach high accuracy and obtain high episode reward. We extract some statistics from performance figures and include them in Table 14. The optimal pair is \(\varepsilon\)-0.034, \(\gamma\)-0.066, reaching 98.86% on the validation set. The worst pair is \(\varepsilon\)-0.036, \(\gamma\)-0.088. It is observed that a small variance of parameters can have a significant impact on the performance.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline \(\varepsilon\) & \(\gamma\) & **Mean Episode Reward** & **Mean Validation Accuracy** \\ \hline
**0.034** & **0.066** & **477.3** & **98.86\%** \\
0.041 & 0.001 & 471.3 & 98.48\% \\
0.070 & 0.170 & 449.8 & 97.73\% \\
0.061 & 0.059 & 22.2 & 54.47\% \\
0.036 & 0.088 & -410.6 & 10.10\% \\ \hline \hline \end{tabular}
\end{table}
Table 14: Experiment results (averaged over the last 10 episodes) without CGAN.  
Figure 10: Performanceson the validation set on DDoS2019 (Validation Accuracy).  
Figure 9: Performances on the validation set on DDoS2019 (Episode Reward). The averaged computation time for training on each episode is 6.912 s.  
Furthermore, we create another two search spaces for the pair \(\varepsilon\) and \(\gamma\) and run the Bayesian search algorithm for the optimal results, which are shown in Table 15. The results inform us that a large \(\gamma\) is not appropriate for our intrusion detection system. If we adjust \(\gamma\) to a relatively small value, we can ensure that the intrusion detection system can always achieve good performance.  
In the second stage, we further strengthen the IDS with CGAN for exploration and data augmentation. Experiment results on the test set are shown in Table 16. Using CGAN, the IDS attains better performance, improved from 93.67% to 96.43%. It proves that CGAN can simulate a more realistic network environment, which leads to performance enhancement.