## 5 Experiments and Evaluation
### Results and Discussion
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Method** & **Accuracy** & **Precision** & **Recall** & **F1 Score** & **AUC-ROC** & **AUC-PR** & **Time (s)** \\ \hline Z-score & 0.76 & 0.62 & 0.78 & 0.69 & 0.78 & 0.65 & 10.5 \\ IQR & 0.80 & 0.65 & 0.80 & 0.71 & 0.82 & 0.67 & 11.2 \\ Grubbs’ test & 0.74 & 0.58 & 0.76 & 0.66 & 0.75 & 0.62 & 12.8 \\ k-means & 0.82 & 0.69 & 0.82 & 0.74 & 0.83 & 0.70 & 45.6 \\ DBSCAN & 0.78 & 0.63 & 0.78 & 0.70 & 0.79 & 0.68 & 62.3 \\ LOF & 0.79 & 0.65 & 0.79 & 0.71 & 0.81 & 0.69 & 53.9 \\ SVM & 0.85 & 0.76 & 0.85 & 0.80 & 0.86 & 0.75 & 132.4 \\ Random & 0.86 & 0.78 & 0.86 & 0.82 & 0.87 & 0.76 & 243.7 \\ Forest & 0.81 & 0.71 & 0.81 & 0.75 & 0.80 & 0.70 & 76.2 \\ k-NN & 0.88 & 0.82 & 0.88 & 0.85 & 0.88 & 0.78 & 180.6 \\ Autoencoder & 0.89 & 0.85 & 0.89 & 0.87 & 0.89 & 0.80 & 215.3 \\ CNN & 0.87 & 0.80 & 0.87 & 0.83 & 0.86 & 0.76 & 198.9 \\ CM-DANA & 0.92 & 0.88 & 0.92 & 0.90 & 0.92 & 0.85 & 315.2 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Performance Comparison of Anomaly Detection Methods. Here are the bar plots comparing all evaluation metrics (Figure 4):  
This comprehensive comparison demonstrates the advantages of the proposed CM-DANA in handling heterogeneous and dynamic data streams. Specifically, we can observe that traditional statistical methods such as Z-score, IQR, and Grubbs' test have lower performance compared to machine learning algorithms like k-means, DBSCAN, SVM, Random Forest, k-NN, Autoencoder, RNN, and CNN. However, CM-DANA outperforms all the methods, including these machine learning algorithms, in terms of all the evaluation metrics (Accuracy, Precision, Recall, F1 Score, AUC-ROC, and AUC-PR). The CM-DANA model is trained end-to-end using multimodal data streams. This allows the model to attend to different features in different modalities based on the model's current state and detect suspicious abnormal behavior by combining the relevant input data from different modalities using adaptive attention weights. To handle the input data as a stream of data in sliding windows, we apply a mask to the attention scores to ignore encoder outputs that are outside of the current window. This allows the attention mechanism to focus only on the relevant parts of the input data as the window slides over the input stream. Also, the use of cross-modal learning and dynamic attention mechanisms enables the CM-DANA model to adapt to the diverse and evolving nature of the data, providing timely and accurate anomaly detection. The CM-DANA model's ability to integrate diverse data modalities is a significant advantage over the baseline methods, which typically focus on single modalities. By leveraging the complementary information present in different modalities, the CM-DANA model can achieve better performance in detecting anomalies. Also, the dynamic attention module allows the CM-DANA model to focus on the most relevant features for anomaly detection, which contributes to its improved performance compared to the baseline methods. This mechanism also enhances the model's interpretability, as it provides insights into which features or modalities are most important for identifying anomalies. The experimental results, in addition, indicate that the CM-DANA model can effectively handle  
Figure 4: Bar plots comparing all evaluation metrics. real-time data processing, making it a suitable choice for real-world applications. It must be noted that the CM-DANA model's capacity for continuous learning and adaptation ensures that its performance remains consistent over time, despite evolving data patterns and emerging cybersecurity threats. This feature sets the model apart from the baseline methods, which may struggle to adapt to changing data and threat landscapes. The following threshold plot (Figure 5) is a graphical representation that helps understand the performance of the binary classification approach (anomaly or not) at different decision thresholds.