## 4 Model Evaluations
### Model Evaluations Associated with CNN and LSTM  
The empirical findings indicate that the LSTM model achieved a high accuracy rate in correctly classifying the majority of the samples (see Table 3). Further analysis shows that the number of data packets in each flow used within the flow duration during the training process increases, the extracted features of the model become more distinguishable, leading to enhanced accuracy in model prediction. The experiment revealed a significant influence of the number of packets per flow on the performance of the model. Since the flow duration and the forward packet are proportionate, their modification is being predicted with high accuracy and a low false positive rate. The results of the observation indicate a notable enhancement in the performance of the model as the number of packets in each flow increases. This means that while understanding the optimal flow, when the transmission is increased abruptly, the model can predict those modifications accurately. The study found that the optimal value of per-flow packet quantity in the network is directly proportional to the increase in data in the CICIDS2017 dataset. Hence, modifications can be easily detected.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **Acc** & **Recall** & **Precision** & **FPR** & **F1-Score** \\ \hline Normal & 99.61 & 93.13 & 93.13 & 0.10 & 99.75 \\ \hline Flow Duration Modification & 99.55 & 94.22 & 94.22 & 0.14 & 95.71 \\ \hline Forward Packet Modification & 99.13 & 90.78 & 90.78 & 0 & 96.64 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Model performance training with LSTM on CICIDS2017 dataset.  
While evaluating the data associated with store-and-forward, the LSTM model performed admirably well in correctly classifying the vast majority of samples. The extracted features of the model become more distinguishable when the number of data packets within each flow used during training is increased, leading to a higher degree of accuracy in model recognition (see Table 4). The false positive rate (FPR) is an essential metric in assessing the accuracy of a model in correctly classifying negative instances. The observed value is significantly low, suggesting that the model demonstrates a recall rate of over 96% for positive instances, accurately identifying them. Additionally, the model accepts a reasonable number of false positives, as indicated by the moderate false positive rate (FPR).  
The empirical results suggest that the CNN model demonstrated a notable level of accuracy in accurately categorizing the majority of the samples, as shown in Table 5. The outcomes demonstrate a consistent pattern when employing long short-term memory (LSTM). However, in terms of prediction performance, the CNN generally exhibits lower performance compared to LSTM. The performance metric has been acknowledged across all instances, as indicated in Table 5.  
The performance of the CNN model was notably high in accurately classifying the store-and-forward data during testing. The utilization of a higher number of data packets from each flow during the training process enhances the model's ability to differentiate between them, resulting in improved accuracy in recognition, as demonstrated in Table 6. Nevertheless, in this particular instance, the performance of convolutional neural networks (CNNs) remains inferior to that of long short-term memory (LSTM). Despite the model's efforts to minimize false positives, it falls short in comparison to LSTM. Nevertheless, it continues to exhibit satisfactory performance.