## 6 Discussion
### Ustc16 Analysis  
When analyzing the USTC16 dataset, the model achieves nearly 100% accuracy with only one packet per flow, demonstrating accuracy approximately equal to that of prior research.  
Our model performed relatively poorly against the Nsis-ay category of malware, but prior methods which did report per-category performance also reported poor performance against one or more categories. Furthermore, the two-packet analysis demonstrated improved performance over the one-packet analysis. After investigating the Nsis-ay category manually, we determine that this category contains UDP flows which closely resemble the UDP traffic from several of the benign categories, such as Facetime and Skype.  
However, we have found that even in most of these cases, most Nsis-ay flows have closer prediction values from the benign and malicious classifiers in the 5-node final layer of the model than those of the benign categories. These two prediction values are currently compared using a simple threshold; whichever value is higher is the prediction which is accepted. However, given that these values are generally very close for the Nsis-ay flows and generally not close for benign samples, adjusting this prediction threshold may be advantageous in future efforts. Analysis of this phenomenon suggests that a dynamic detection threshold may be able to increase accuracy to approximately 97% in the Nsis-ay category. Additionally, our two-packet analysis has already partially resolved the issue without any changes to the model.  
\begin{table}
\begin{tabular}{l r r r r r r} \hline \hline \multicolumn{6}{c}{**Results Overview (1 Packet per Flow)**} \\ \hline \multicolumn{1}{c}{\multirow{2}{*}{**Datasets**}} & \multicolumn{1}{c}{**Balanced Accuracy**} & \multicolumn{1}{c}{**Recall Precision**} & \multicolumn{1}{c}{**FNR**} & \multicolumn{1}{c}{**FPR**} & \multicolumn{1}{c}{**F1 Score**} \\ \hline CIC17 & 90.6 & 84.3 & 95.6 & 15.7 & 3.2 & 89.6 \\ USTC16 & 100.0 & 100.0 & 100.0 & 0.0 & 0.0 & 100.0 \\ USTA21 & 100.0 & 100.0 & 100.0 & 0.0 & 0.0 & 100.0 \\ CIC17+USTC16 & 88.4 & 90.0 & 86.5 & 10.0 & 13.1 & 88.2 \\ CIC17+UTSA21 & 91.8 & 87.6 & 95.3 & 12.4 & 4.0 & 91.3 \\ USTC16+UTSA21 & 99.8 & 99.7 & 99.9 & 0.3 & 0.1 & 99.8 \\ CIC16+USTC16+UTSA21 & 89.2 & 93.8 & 85.5 & 6.2 & 15.5 & 89.4 \\ \hline \multicolumn{6}{c}{**Results Overview (2 Packets per Flow)**} \\ \hline \multicolumn{1}{c}{\multirow{2}{*}{**Datasets**}} & \multicolumn{1}{c}{**Balanced Accuracy**} & \multicolumn{1}{c}{**Recall Precision**} & \multicolumn{1}{c}{**FNR**} & \multicolumn{1}{c}{**FPR**} & \multicolumn{1}{c}{**F1 Score**} \\ \hline CIC17 & 93.2 & 90.8 & 94.4 & 9.2 & 4.4 & 92.6 \\ USTC16 & 100.0 & 99.9 & 100.0 & 0.1 & 0.0 & 100.0 \\ USTA21 & 100.0 & 100.0 & 100.0 & 0.0 & 0.0 & 100.0 \\ CIC17+USTC16 & 95.3 & 94.0 & 96.2 & 6.0 & 3.4 & 95.1 \\ CIC17+UTSA21 & 94.2 & 92.5 & 95.6 & 7.5 & 4.0 & 94.0 \\ USTC16+UTSA21 & 99.9 & 99.8 & 99.9 & 0.2 & 0.1 & 99.9 \\ CIC16+USTC16+UTSA21 & 95.4 & 94.7 & 96.0 & 5.3 & 3.8 & 95.3 \\ \hline \hline \end{tabular}
\end{table}
Table 4: An overview of the results from training and testing on equal amounts from each category in each of the three datasets in various combinations as listed in Table 2. In general, any case containing CIC-DoS17 traffic demonstrates lower accuracy, but every case not containing that traffic has nearly 100% accuracy.