## 4 Results and Discussion
### Results  
#### 4.1.1 AdaBoost  
This model was trained on the first dataset, CIC-MalMem-2022, with an accuracy of 99.94%. Based on the confusion matrix shown in Figure 3, the model correctly predicted 5805 malicious and 5802 benign instances. However, two malicious instances were incorrectly predicted as benign, and four benign instances were incorrectly predicted as malicious. For CIC-IDS-2018, the accuracy was 99.11%, and the confusion matrix in Figure 4 indicates that the model correctly predicted 2059 malicious instances and 4418 benign instances. Nevertheless, 13 malicious instances were incorrectly predicted as benign, and 45 benign instances were incorrectly predicted as malicious. CIC-IDS-2017 had an accuracy rate of 98.64%, and the confusion matrix in Figure 5 shows that the model accurately predicted 6235 malicious instances and 6936 benign instances. However, 115 malicious instances were incorrectly predicted as benign, while 66 benign instances were incorrectly predicted as malicious. The learning curve for the CIC-MalMem-2022 dataset is depicted in Figure 6, which shows that the training score is 100% accurate in every rotation; however, cross-validation scores show different accuracy levels in each cycle. The cross-validation score starts at 99.82%, reaches 99.88% with training examples ranging from 20,000 to 30,000, and then continues with an accuracy of 99.86%. These training and validation percentage results indicate no evidence that overfitting has occurred. Figure 7 presents the learning curve for the CIC-IDS-2018 dataset, which shows that the training scores have an accuracy of around 99.99% in every cycle, but cross-validation scores range from 94% to 96%. By comparing the results of training and cross-validation, it is apparent that the model is balanced. In Figure 8, the learning curve for the CIC-IDS-2017 dataset indicates that the model performs well in both training and cross-validation, as demonstrated by the high scores in both training and cross-validation. There is a slight difference in training and cross-validation scores, which is a typical pattern. Thus, the model does not overfit the training data. The effective hyperparameter for the AdaBoost model is n_estimators. Five values are assigned to check the best n_estimators, and they are 80, 100, 150, 200, and 250; for the experiment on the CIC-MalMem-2022 dataset, the best value is 80, with a time of  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**ML Algorithm** & **Hyperparameter** & **Values** \\ \hline AdaBoost & n\_estimators & 80, 100, 150, 200, 250 \\ Voting & voting & Hard, soft \\ Stacking & passthrough & True, False \\ SVM & Regularization parameter (C) & 0.1, 0.9, 10.0, 50.0, 100.0 \\ RF & max\_depth & 2, 3, 5, 10, 20 \\ XGBoost & Learning rate & 0.5, 0.7, 1, 2, 10 \\ \hline \hline \end{tabular}
\end{table}
Table 8: Hyperparameter and tuning values for each ML algorithm.  
0.102 s; moreover, all values yield 100% accuracy, as shown in Figure 9; so, in this case, it is necessary to check the time. For the CIC-IDS-2018 dataset, the best parameter is 100, with a mean test score of 99.40% and a mean test time of 0.191 s. Figure 10 illustrates the relationship between n_estimators and their accuracy. According to Figure 11, the best parameter for the CIC-IDS-2017 dataset is 250. The mean test score and mean test time for the CIC-IDS-2017 dataset are 99.24% and 0.358 s, respectively.  
Figure 4: Confusion matrix for AdaBoost on CIC-IDS-2018 dataset.  
Figure 3: Confusion matrix for AdaBoost on CIC-MalMem-2022 dataset.  
Figure 5: Confusion matrix for AdaBoost on CIC-IDS-2017 dataset.  
Figure 6: Learning curve for AdaBoost on CIC-MalMem-2022 dataset.  
Figure 7: Learning curve for AdaBoost on CIC-IDS-2018 dataset.  
Figure 8: Learning curve for AdaBoost on CIC-IDS-2017 dataset.  
Figure 10: Hyperparameter tuning for AdaBoost on CIC-IDS-2018 dataset.  
Figure 9: Hyperparameter tuning for AdaBoost on CIC-MalMem-2022 dataset.