## 5 Tests
### Search for the Minimum Set of Features
In contrast, in most of the papers referenced, there was no precise information on how the metrics for multi-class classification were counted. In addition, the most recent classification results obtained on each of the four subsets of the NF-UQ-NIDS-v2 dataset are added. For each table record, the exact number of processed features is provided. The next phase of the tests is devoted to checking the decision trees' speed. For this purpose, we performed the measurement of their inference times computed on the entire test set--see Table 7. Each value represents the time needed by the corresponding classifier to load the test data and perform the classification. The examination involves classifying test data that represent 10% of the dataset, i.e., nearly 7.6 million samples. It could be seen \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Method** & **Dataset** & **Feat.** & **Acc.** & **Rec.** & **Prec.** \\ \hline RF with Explainable AI [62] & UNSW-NB15 & 7 & 96.7\% & 94.7\% & 96.1\% \\ \hline Three-level algorithms [63] & part of BoT-IoT & 44 & 100\% & 100\% & 100\% \\ \hline Inception Time [64] & ToN-IoT & 42 & 99.7\% & 99.6\% & 99.7\% \\  & UNSW-NB15 & 43 & 98.6\% & 98.4\% & 98.9\% \\ \hline MLP with backpropagation [65] & CIC-CSE-IDS2018 & 24 & 99\% & 98.8\% & 100\% \\ \hline RF [45] & part of NF-UQ-NIDS-v2 & 6 & 99.1\% & 99\% & 99\% \\ \hline Autoencoder with MLP [46] & part of NF-UQ-NIDS-v2 & 42 & 100\% & 94.2\% & 98.9\% \\ \hline Transformer with Neighborhood Clean-ing Rule [47] & NF-BoT-IoT-v2 & 40 & only F1 is provided: 85.6\% \\  & NF-CSE-CIC-IDS2018-v2 & 40 & only F1 is provided: 88.7\% \\ \hline Graph Neural Network with Self-supervised learning [48] & part of NF-UQ-NIDS-v2 & 43 & only F1 is provided: 85\% \\  & part of ToN-IoT & 40 & only F1 is provided: 98\% \\ \hline  & UNSW-NB15-v2 & 10 & 100\% & 100\% & 100\% \\  & BoT-IoT-v2 & 10 & 100\% & 100\% & 100\% \\ RF [21] & ToN-IoT-v2 & 10 & 100\% & 100\% & 100\% \\  & NF-CSE-CIC-IDS2018-v2 & 10 & 100\% & 100\% & 100\% \\  & NF-UQ-NIDS-v2 & 10 & 98\% & 98\% & 98\% \\ \hline Our approach & NF-UQ-NIDS-v2 & 8 & 95.3\% & 95.3\% & 95.1\% \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Results obtained in studies of NF-UQ-NIDS-v2 and its subsets. \begin{table}
\begin{tabular}{l c c c c} \hline \hline  & \multicolumn{2}{c}{**Accuracy/Recall**} & \multicolumn{2}{c}{**Precision**} \\
**Features** & **Random Forest** & **Decision Tree** & **Random Forest** & **Decision Tree** \\ \hline
1 & 88.5\% & 78.8\% & 88.9\% & 75.6\% \\
2 & 90.6\% & 83.2\% & 91.5\% & 83.3\% \\
3 & 91.6\% & 88.3\% & 91.0\% & 88.7\% \\
4 & 93.0\% & 90.7\% & 92.5\% & 89.9\% \\
5 & 92.7\% & 90.7\% & 92.6\% & 89.9\% \\
6 & 92.8  
that samples with 30 features were tested in 1.86 s, so it is four times longer than just a single-feature sample. Both training samples and testing ones contained the same number of features. For instance, the tree that was tested on ten features was trained beforehand on ten features, etc. The calculations were conducted using Python. The following parameters were used to create decision trees (Scikit-learn): criterion, _log_loss_; splitting strategy, _best_; and minimum number of samples to split a node, 2. As in previous tests, 90% of the given samples were used in the training phase, whereas 10% was used during testing. Figure 4 displays the times needed to classify the given number of features. Each blue dot refer to the classifier built using number of features being its x-coordinate. Analyzing the test time needed for offline classification (see Table 7 and Figure 4), one can see that even for 30 features, it is reasonable. Selecting the optimal features decreases the number of times around 1 s with fewer features. The experiments were conducted on a regular computer with an Intel Core i5 12-gen computer with 16 GB of DDR4 RAM and processor-integrated Intel Iris Xe Graphics. Implementing those algorithms in dedicated hardware instead of software solutions can lead to almost real-time detection systems.