# Explainable Lightweight Block Attention Module Framework for Network-Based IoT Attack Detection
## 4 Experimental Results
### Discussion
#### 4.2.1 Performance Evaluation on Bot-IoT Dataset  
Our proposed strategy's multi-class classification is shown in Table 2. The table illustrates that the performance of our proposed method across all classes was superior. The Bot-IoT dataset achieved 99.87% and 99.68% accuracy in the DDoS and DoS classifications, respectively. The performance on theft and reconnaissance classes was marginally worse than that on other classes. Only 99% (theft) and 98.67% (reconnaissance) accuracy were achieved in those classes using our suggested approach. The behavior on reconnaissance assaults was similar to the DDoS/DoS attack behavior mirrored in the current feature set. This activity makes it more challenging using the model to identify the difference between those two attacks.  
Figure 4 displays a visual depiction of Table 2. From the figure, it is observed that the F1 (99.89%), recall (99.96%), precision (99.93%), and accuracy (99.87%) value of the DDoS class was higher than that for all other classes. Overall, the results were positive for all types of attacks. However, the reconnaissance class received the lowest grade because it resembled regular data. Moreover, theft-exfiltration also attained the least values because a few instances in the dataset were mistakenly classified as belonging to a different class.  
After the multi-class classification, the proposed approach's results were compared with the existing intrusion detection techniques evaluated on the Bot-IoT dataset, as shown in Table 3. The table shows that the proposed approach's precision, accuracy, F1, and recall were more significant than those of other existing techniques, which means that the proposed framework dramatically reduced the false positives in most classes. Compared to all other techniques, the support vector machine (SVM)'s performance could have been better and more accurate because it incorrectly divided all theft assaults into various classes. Additionally, many attacks were misidentified as regular packets, demonstrating the inability of SVM in intrusion detection.  
Compared to all other approaches, the overall performance of XGBoost was superior. However, the accuracy of k-nearest neighbor (KNN) (99.03%) was higher than that of XGBoost (98.96%) because it easily handled multi-class cases and achieved better accuracy than SVM. The performance of C4.5 was also better than that of SVM. Nevertheless, merely one metric (accuracy) (Figure 5) does not adequately capture how effective the technique was at classifying intrusions. Last but not least, the results of the suggested strategy  
\begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Techniques** & **Precision** & **Recall** & **F1** & **Accuracy** \\ \hline
**Normal** & 99.78 & 99.89 & 99.74 & 99.69 \\ \hline
**DDoS** & 99.93 & 99.96 & 99.89 & 99.87 \\ \hline
**Dos** & 99.79 & 99.86 & 99.81 & 99.68 \\ \hline
**Theft** & 99.11 & 99.32 & 99.14 & 99 \\ \hline
**Reconnaissance** & 98.69 & 99.05 & 98.91 & 98.67 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Multi-class classification on Bot-IoT dataset.  
Figure 4: Multi-class classification on Bot-IoT dataset.  
acquired using the Bot-IoT dataset show that our technique produced more practical outcomes when compared to other techniques.