## 3 Methodology
### Rlfoula Framework Description
#### 3.2.3 Employing Functional Agents in RL
### Preliminary Application of RLPOUA Framework on CSE-CIC-IDS2018 Dataset

The RLPOUA framework, which compares different sequences and combinations of machine learning algorithms and resampling algorithms, identified the top-performingalgorithm combinations, listed in Table 1 in descending order. The results shown in this table highlight the precision, recall, and F1 score for each algorithm combination, categorized by the data sample classification (benign and infiltration). The RLFOUA framework determines that the algorithm combination of Balanced Bagging Classifier, Random Oversampling, Random Undersampling, and TFRSMOTE achieves the highest performance with an F1 score of 0.9998 for the \"benign\" class and 0.9784 for the \"infiltration\" class. This is followed by the Random Forest Classifier, which achieves an F1 score of 0.9999 for the \"benign\" class and 0.9910 for the \"infiltration\" class. The Bagging Classifier and Extra Trees Classifier also exhibit strong performance, although the Bagging Classifier has relatively lower precision for the \"infiltration\" class. The exceptional performance of certain algorithm combinations, notably the Balanced Bagging Classifier with specific resampling techniques, can be attributed to their ability to effectively handle the complex nature of the CSE-CIC-IDS2018 dataset. This dataset exhibits a considerable class imbalance between benign and infiltration samples, making it challenging for traditional algorithms to discern between the two classes accurately. The combination of techniques employed, including random oversampling, random undersampling, and TFRSMOTE, work synergistically to address this imbalance. Random oversampling augments the minority class, ensuring that it contributes meaningfully to the learning process. Conversely, random undersampling helps mitigate the dominance of the majority class, preventing it from overshadowing the learning process. Additionally, TFRSMOTE fine-tunes the sampling process, adapting dynamically to the dataset's characteristics. This strategic combination of techniques results in a more balanced and representative training set, enabling the algorithms to make informed decisions and achieve exceptional performance in detecting both benign and infiltration attacks. The effectiveness of these combinations underscores the significance of tailored resampling strategies in enhancing intrusion detection systems, particularly in scenarios with imbalanced datasets. ### Preliminary Application of RLFOUA Framework on NSL-KDD Dataset

In order to assess the generalizability of the RLFOUA framework across different datasets, we apply it to the NSL-KDD dataset and present a summary of the results in Ta \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Algorithm** & **Attack Type** & **Precision** & **Recall** & **F1 Score** & **Support** & **Accuracy** \\ \hline Balanced Bagging Classifier & Benign & 1 & 0.9996 & 0.9998 & 7322 & 0.9996 \\ Random Oversampling & \multirow{2}{*}{Infiltration} & 0.9577 & 1 & 0.9784 & 68 & \\ \hline Random Forest Classifier & Benign & 1 & 0.9999 & 0.9999 & 7308 & 0.9999 \\ Random Oversampling & \multirow{2}{*}{Infiltration} & 0.9821 & 1 & 0.991 & 55 & \\ \hline Extra Trees Classifier & Benign & 0.9999 & 0.9986 & 0.9992 & 7308 & 0.9985 \\ \cline{2-6} Neighborhoodsine & \multirow{2}{*}{Infiltration} & 0.8485 & 0.9836 & 0.9106 & 57 & \\ \hline Bagging Classifier & Benign & 0.9999 & 0.9966 & 0.9982 & 7322 & 0.9965 \\ \cline{2-6} ADASYN & \multirow{2}{*}{Infiltration} & 0.7059 & 0.9825 & 0.8219 & 61 & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Classification report for the validation set of CSE-CIC-IDS2018 dataset, comprising different algorithm and sampling technique combinations within the RLFOUA framework for infiltration attack, arranged in descending order of performance metrics. ble 2. The table displays the classification report of the RLFOUA framework, incorporating four of the best-performing algorithms along with TRFSMOTE.