## 4 Results and Discussion
### Data Generation Performance Testing  
Tables 4 and 5 show that the dataset statistics were balanced using CTGAN compared with the real dataset statistics in Table 4. The \"keylogging\" and \"theft\" attacks have the lowest instance number. After applying CTGAN, they significantly increased from 135 instances of keylogging (to 21,686) and 423 instances of theft (to 8087). The dataset was distributed according to the CTGAN, which was implemented on all attack and normal datasets to generate the instances. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Category** & **Count** & **Percentage (\%)** \\ \hline DDOS & 17,923 & 5.35 \\ DOS & 17,204 & 5.13 \\ injection & 17,708 & 5.28 \\ keylogging & 135 & 0.04 \\ password & 17,587 & 5.25 \\ mqtt\_bruteforce & 16,820 & 5.02 \\ scan\_A & 16,009 & 4.78 \\ ransomware & 15,734 & 4.69 \\ backdoor & 16,464 & 4.91 \\ XSS & 15,766 & 4.70 \\ Sparta & 17,148 & 5.12 \\ theft & 423 & 0.13 \\ normal & 166,249 & 49.60 \\ Total & 335,170 & 100.00 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Collected real dataset count and statistics. Figure 4: The proposed pipeline design. Table 6 shows that the performance increased from 0.80 (50 epochs) to 0.83 (70 epochs) and then decreased to 0.82 until 100 epochs. This indicates that 70 epochs exhibited the highest performance according to the KS test, and they are used to perform further measurements using ML efficiency metrics, as adopted by [13; 46]. To further support the KS test's results, the overall performance shown in Table 6 according to the root mean square error (RMSE) and mean absolute error (MAE) [47] shows low error values of less than 1 [48; 49], as presented in Algorithm 1. Another method for assessing the quality of the generated dataset, which was proposed by [50], is known as the train on synthetic, test on real (TSTR) data. The method can be applied using the dataset generated by CTGAN as a training dataset for machine learning models; then, the real dataset is used to test the models. Researchers used this method to determine whether the generated dataset using GAN methods is suitable for real applications for ML-based IDS [47; 51; 52]. In this paper, the TSTR method is used to further investigate the statistical method's results, aiming to select the number of epochs for use with machine learning efficiency metrics to compare the results with the related studies. Section 4.2 introduced the configuration of the machine learning models that were used. Table 7 presents the results of using TSTR on the ML models. Although some models showed low accuracy, using RF consistently achieved high accuracy (0.98), indicating that it is suitable for this ML-based IDS context and can capture complex relationships. Moreover, the average accuracy line provides an overall sense of how well synthetic data perform as a training set across different models. Using 70 epochs showed a higher average accuracy on TSTR, which was 0.85, followed by a slight decline, supporting the statistical metrics' findings for selecting the optimal number of epochs for ML efficiency metrics. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Epochs** & **50** & **60** & **70** & **80** & **90** & **100** \\ \hline KS test & 0.80 & 0.82 & 0.83 & 0.82 & 0.82 & 0.82 \\ RMSE & 0.13 & 0.12 & 0.11 & 0.11 & 0.12 & 0.12 \\ MAE & 0.09 & 0.08 & 0.08 & 0.08 & 0.08 & 0.08 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: KS test, MAE, and RMSE metrics’ comparison between epochs. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Category** & **Count** & **Percentage (\%)** \\ \hline DDOS & 13,282 & 3.96 \\ DOS & 12,047 & 3.59 \\ injection & 13,933 & 4.16 \\ keylogging & 12,026 & 3.59 \\ password & 12,852 & 3.83 \\ mqtt\_bruteforce & 21,686 & 6.47 \\ scan\_A & 14,203 & 4.24 \\ ransomware & 21,358 & 6.37 \\ backdoor & 14,849 & 4.43 \\ XSS & 11,986 & 3.58 \\ Sparta & 12,612 & 3.76 \\ theft & 8087 & 2.41 \\ normal & 166,249 & 49.60 \\ Total & 335,170 & 100.00 \\ \hline \hline \end{tabular}
\end{table}