## 4 Experimental Results and Analysis
### CIC-IDS2017 Results and Analysis  
We conducted a comprehensive evaluation and comparison of CBF-IDS with other algorithms on the CIC-IDS2017 dataset. The experimental results clearly show that CBF-IDS surpasses other algorithms in all performance metrics. Particularly, CBF-IDS achieves an exceptional F1 score of 99.53% on the CIC-IDS2017 dataset. Table 14 presents a comprehensive overview of the multi-classification performance of CBF-IDS and other algorithms on the CIC-IDS2017 dataset, highlighting the best metrics in bold. Table 14 illustrates that CBF-IDS with focal loss outperforms other loss functions in multi-classification performance on CIC-IDS2017. We also tested models based on different structures that use focal loss for multi-classification performance on the CIC-IDS2017, as shown in Table 15. The best metrics are highlighted in bold. From Table 15, it is evident that increasing the number of convolutional layers enhances model performance. Furthermore, we observe that, under the same convolutional structure, the CNN-BiLSTM hybrid model is superior to pure CNN models. We conducted a comprehensive evaluation and comparison of the performance of CBF-IDS on various traffic types for the CIC-IDS2017 dataset. Table 16 displays the precision, recall, and F1 scores of the CNN-BiLSTM model utilizing three distinct loss functions: CE, \(\alpha\)-balanced CE, and focal loss. The best F1 scores are highlighted in bold. CBF-IDS exhibits outstanding performance when assessed across all traffic types. Except for Patator, CBF-IDS attains the highest F1 scores in all remaining categories. Figure 9 shows that CBF-IDS achieves superior performance metrics for the minority class Bot in terms of precision, recall, and F1 score, reaching 91.97%, 96.18%, and 94.03%, respectively. Notably, CBF-IDS outperforms CBC-IDS in all aspects of minority-class Bot detection. Specifically, CBF-IDS demonstrates improvements of 7.03%, 31.70%, and 19.10% for precision, recall, and F1 score, respectively, compared to CBC-IDS. Moreover, as observed from Figure 9, despite its precision being relatively lower than that of CBA-IDS, CBF-IDS exhibits improvements of 7.99% in recall and 2.90% \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Algorithm** & **Accuracy** & **Precision** & **Recall** & **F1 Score** \\ \hline SVM & 92.66 & 92.16 & 92.66 & 91.91 \\ KNN & 98.91 & 98.92 & 98.91 & 98.91 \\ [23] & 97.72 & 97.73 & 97.72 & 97.68 \\ [24] & 96.86 & 96.97 & 96.86 & 96.83 \\ [25] & 99.40 & 99.39 & 99.40 & 99.38 \\ CBC-IDS & 98.72 & 98.79 & 98.72 & 98.73 \\ CBA-IDS & 98.97 & 99.04 & 98.97 & 98.99 \\ CBF-IDS & **99.53** & **99.54** & **99.53** & **99.53** \\ \hline \hline \end{tabular}
\end{table} 
Table 14: Performance of multi-classification for CIC-IDS2017. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Model** & **Layer** & **Accuracy** & **Precision** & **Recall** & **F1 Score** \\ \hline CNN & 1 Conv & 95.65 & 95.64 & 95.65 & 95.61 \\
2 Conv & 2 Conv & 97.83 & 97.86 & 97.83 & 97.80 \\
3 Conv & 98.72 & 98.77 & 98.72 & 98.73 \\ BiLSTM & 1 BiLSTM & 98.36 & 98.42 & 98.37 & 98.36 \\
1 Conv + 1 BiLSTM & 98.01 & 98.06 & 98.01 & 98.00 \\ CNN-BiLSTM & 2 Conv + 1 BiLSTM & 98.92 & 98.94 & 98.92 & 98.91 \\
3 Conv + 1 BiLSTM * & **99.53** & **99.54** & **99.53** & **99.53** \\ \hline \hline \end{tabular}
\end{table} 
Table 15: Multi-classification performance of different model structures on CIC-IDS2017. Figure 9 presents CBF-IDS, which achieves superior performance metrics for the minority class Infiltration in terms of precision, recall, and F1 score, reaching 100.00%, 85.71%, and 92.31%, respectively. It can be observed from Figure 9 that the CNN-BiLSTM model using the three different loss functions all achieve a precision of 100% for Infiltration. This can be attributed to the limited amount of Infiltration traffic and its similarity to normal traffic, which allows it to evade IDS [55; 56].