## 4 Results and Discussion  
The proposed model is simulated using Python 3.6.5 tool on a PC i5-8600k, with GeForce 1050 Ti 4 GB, 16 GB RAM, 250 GB SSD, and 1 TB HDD. As the DCNN model has parameters, the hyperparameter tuning process is performed. The learning rate is kept as 0.01. The number of filters is 32 in the primary CNN layer, 64 in the succeeding CNN layer, and 128 in the last CNN layer. The parameter max-pooling length is set to 2 in all the max-pooling layers, and dropout to 0.01. When the number of CNN layers increases from three to four, the performance is reduced and, therefore, a three-level CNN is used. Lastly, two dense layers are included along with the CNN layer; the first dense layer is composed of 512 neurons and the second layer is composed of 128 neurons. These layers use ReLU as the activation function. The experimental validation of the PODCNN-LWID model is tested using a dataset comprising 5500 samples with 11 classes, as depicted in Table 1. We used the CICIDS2017 dataset, which is comprised of normal and the most up-to-date common attacks, and resembles the true, real-world data (PCAPs). The dataset is available at [[https://www.unb.ca/cic/datasets/ids-2017.html](https://www.unb.ca/cic/datasets/ids-2017.html)]([https://www.unb.ca/cic/datasets/ids-2017.html](https://www.unb.ca/cic/datasets/ids-2017.html)) (accessed on 13 June 2022). It encompasses the network traffic analyses results from the use of CICFlowMeter, with labeled flows based on the time stamp, source and destination IPs, source and destination ports, protocols, and attacks (CSV files). This dataset was gathered for five continuous days (Monday-Friday), with various attacks as well as normal information. The proposed model is simulated using the Python tool. The set of measures used to examine the results are accuracy, precision, recall, specificity, and _F-score_. Figure 3 illustrates the confusion matrix offered by the PODCNN-LWID model with the entire dataset. The PODCNN-LWID model identifies 493 samples in class 1; 481 samples in class 2; 490 samples in class 3; 484 samples in class 4; 483 samples in class 5; 485 samples in class 6; 490 samples in class 7; 484 samples in class 8; 470 samples in class 9; 493 samples in class 10; and 492 samples in class 11. Table 2 reports the intrusion classification output of the PODCNN-LWID model with the entire dataset. In class 1, the PODCNN-LWID model provides \(accu_{y}\), \(prec_{n}\), \(rec_{al}\), \(spec_{y}\), and \(F_{score}\) values of 99.75%, 98.60%, 98.60%, 99.86%, and 98.60%, respectively. In the meantime, in class 2, the PODCNN-LWID approach offers \(accu_{y}\), \(prec_{n}\), \(rec_{al}\), \(spec_{y}\), and \(F_{score}\) values of 99.62%, 99.59%, 96.20%, 99.96%, and 97.86%, respectively. Likewise, in class 3, the PODCNN-LWID technique presents \(accu_{y}\), \(prec_{n}\), \(rec_{al}\), \(spec_{y}\), and \(F_{score}\) values of 99.82%, 100%, 98%, 100%, and 98.99%, respectively. Moreover, in class 4, the PODCNN-LWID algorithm renders \(accu_{y}\), \(prec_{n}\), \(rec_{al}\), \(spec_{y}\), and \(F_{score}\) values of 99.67%, 99.59%, 96.80%, 99.96%, and 98.17%, respectively. Finally, in class 5, the PODCNN-LWID approach grants \(accu_{y}\), \(prec_{n}\), \(rec_{al}\), \(spec_{y}\), and \(F_{score}\) values of 99.67%, 99.79%, 96.60%, 99.98%, and 98.17%, respectively. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Label** & **Class** & **No. of Instances** \\ \hline
1 & Normal & 500 \\
2 & Botnet & 500 \\
3 & DoSölsouthftptest & 500 \\
4 & FTP-Pataotr & 500 \\
5 & SSH-Pataotr & 500 \\
6 & DoSGoldenEye & 500 \\
7 & DoSölslowloris & 500 \\
8 & Heartbleed & 500 \\
9 & PortScan & 500 \\
10 & DDoS & 500 \\
11 & DoSHulk & 500 \\ \hline \multicolumn{3}{c}{**Total No. of Instances**} & **5500** \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Dataset details. Figure 3: Confusion matrix of PODCNN-LWID approach with entire dataset. Figure 4 demonstrates the confusion matrix offered by the PODCNN-LWID technique for 70% of the TR dataset.