## 3 Experiments
### Introduction to the Data Set  
When choosing datasets for intrusion detection classifier performance comparison experiments, it is essential to consider the following factors:  
Diversity of datasets: Select datasets from various types and sources to ensure the results are comprehensive and applicable to different scenarios. Size of the dataset: Choose datasets with an adequate sample size to ensure the reliability and statistical significance of the experimental findings. \begin{table}
\begin{tabular}{c c} \hline \hline
**Hyperparameters** & **Type and Value Range** \\ \hline learning\_rate & Floating point type, [0, 1] \\ max\_depth & Integer type, [1, 16] \\ iterations & Integer type \\ min\_data\_in\_leaf & Integer type, [1, 100] \\ l2\_leaf\_reg & Floating point type, [0, 10] \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Parameters of the search and related information. Figure 7: Optuna principle schematic. The authenticity of the dataset: Prefer real-world datasets whenever possible, as they reflect the complexities and characteristics of actual intrusion scenarios more accurately than synthetic or artificially generated datasets. Based on these considerations, the following three datasets are recommended for intrusion detection classifier performance comparison experiments. (1) NSL-KDD dataset:  
The NSL-KDD dataset is a revised version of the KDD-99 dataset, removing redundant and unnecessary data while retaining both normal and attack connections. The NSL-KDD dataset \"[[https://www.unb.ca/cic/datasets/nsl.html](https://www.unb.ca/cic/datasets/nsl.html)]([https://www.unb.ca/cic/datasets/nsl.html](https://www.unb.ca/cic/datasets/nsl.html)) (accessed on 1 May 2023)\" [37] offers improved data quality and a more balanced distribution of classes. Consequently, this study selects the files KDDTrain+ and KDDTest+ from the NSL-KDD dataset as the training and testing sets for the classifier. Each record in the dataset consists of 43 features, with the last column representing four different types of access (DOS, PROBE, R2L, U2R) and one normal access. The specific composition and scale of the dataset are detailed in Table 8.  
(2) UNSW-NB15 dataset:  
The UNSW-NB15 dataset is a network intrusion detection dataset developed by the University of New South Wales \"[[https://research.unsw.edu.au/projects/unsw-nb1](https://research.unsw.edu.au/projects/unsw-nb1)]([https://research.unsw.edu.au/projects/unsw-nb1](https://research.unsw.edu.au/projects/unsw-nb1)) 5-dataset (accessed on 1 May 2023)\" [38; 39; 40; 41; 42]. It comprises real network traffic records, encompassing normal connections and various types of attacks, thus offering a more precise reflection of the threats and attacks prevalent in modern network environments. Utilizing the UNSW-NB15 dataset facilitates the assessment of classifiers in highly realistic and intricate network scenarios. The dataset includes nine types of attacks, namely Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode, and Worms. Each flow data within the dataset is characterized by 48 features. The training set in the CSV file encompasses 175,341 records, while the test set contains 82,332 records. The specific composition and scale of the dataset are outlined in Table 9.  
3. CICIDS2017 dataset:  
The CICIDS2017 dataset [[https://www.unb.ca/cic/datasets/ids-2017.html](https://www.unb.ca/cic/datasets/ids-2017.html)]([https://www.unb.ca/cic/datasets/ids-2017.html](https://www.unb.ca/cic/datasets/ids-2017.html)) (accessed on 1 May 2023) [43], is developed by the Canadian Department of National Defence's Research and Development Canada (DRDC) for network intrusion detection. It comprises data traffic records from real-world network environments, including normal connections and various types of attacks. The dataset offers a substantial number of samples and diverse attack scenarios, featuring five major categories of attack accesses and one category for normal access, with each data entry containing 78 features.