## 4 Results and Discussion
### Datasets Description  
The original dataset contains labels for both multi-class and binary class classification. The class-wise number of instances in each class is shown in Table 2. The table shows that the instances for the normal class are too many as compared to other categories of network attacks. Therefore, the more instances for attacked classes are generated using the GAN model, and their numbers are shown in Table 2. The normal class instances are enough to use in classification; therefore, more instances for the normal class are not generated. The final collective dataset using original and GAN datasets is also described in Table 2, in correspondence to the total instances against each class.  
The dataset in detail described against each category is shown in Table 2. The instances of each category in Column 2 show the training and testing sets provided by the UNSW-NB15 dataset originally. The binary classification is based on all attacks considered as attacks, where the normal is considered a negative class in that category. The last row shows almost 64 attacked class data as compared to the normal class instances that are the remaining 36% of data. We see here that the percentage against a single class is 36%, which is a problem in binary classification, where in multi-class classification, it is greater, as a few of the categories, such as worms, are very low in the whole dataset. To solve it separately against each class, the GAN is applied on each category separately and the new corresponding instances are made against them, shown in Column 3.  
The number of new instances against each category is slightly lower as compared to the original dataset instances of similar categories. Higher number of given instances for a category of GAN create new instances in a similar way, either in terms of the value or number of instances. However, the normal and attacked instances using GAN show 57% for attacked classes and 43% for normal class. Although it is less compared to the original dataset instances, it plays an important role in the creation of a new and more balanced dataset in favor of attacked classes. The new dataset contains collectively 75% for attacked classes and 25% for the normal class, which is better compared to original  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Classes** & **Original Instances (Train + Test)** & \
\begin{tabular}{c} **GAN-Based Instances** \\ **(Train + Test)** \\ \end{tabular} &
\begin{tabular}{c} **Original + GAN-Based** \\ **Instances** \\ \end{tabular} \\ \hline Analysis & 2000 + 677 = 2677 & 1477 + 453 = 1930 & 4607 \\ \hline Backdoor & 1746 + 583 = 2329 & 1264 + 366 = 1630 & 3959 \\ \hline DoS & 12,264 + 4089 = 16,353 & 9588 + 2746 = 12,334 & 28,687 \\ \hline Exploits & 33,393 + 11,132 = 44,525 & 26,217 + 7588 = 33,805 & 78,330 \\ \hline Fuzzers & 18,184 + 6062 = 24,246 & 14,089 + 4150 = 18,239 & 42,485 \\ \hline Generic & 40,000 + 18,871 = 58,871 & 31,609 + 12,984 = 44,593 & 103,464 \\ \hline Reconnaissance & 10,491 + 3496 = 13,987 & 8132 + 2348 = 10,480 & 24,467 \\ \hline Shellcode & 1133 + 378 = 1511 & 827 + 207 = 1034 & 2545 \\ \hline Worms & 130 + 45 = 175 & 54 + 15 = 69 & 244 \\ \hline Normal & 56,000 + 37,000 = 93,000 & 56,000 + 37,000 = 93,000 & 93,000 \\ \hline Total (Attacked + Normal) & 164,674 + 93,000 = 257,674 & 124,060 + 93,000 = 217,060 & 288,788 + 93,000 = 381,788 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Proposed-framework-based original and generated dataset instances against each category.  
and GAN-based instances. However, the classification for multi-class and binary is discussed on each of these datasets to check the validity of the created dataset and its instances.