## 4 Experimental Results and Analysis
### Runtime Results and Analysis  
In the same experimental environment, we conducted a comparison and analysis of the runtime of CBF-IDS with other algorithms. In order to obtain reliable runtime results and analysis, we performed multiple experiments and recorded the training and testing times for each epoch. The final results are based on the averages from these multiple experiments. Table 17 displays the training and testing times for each epoch of CBF-IDS and other algorithms for the NSL-KDD dataset. From the data in Table 17, it is evident that CBF-IDS has the longest training time for a single epoch, which is 71.14 s, and a testing \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Class**} & \multicolumn{3}{c}{**CBC-IDS**} & \multicolumn{3}{c}{**CBA-IDS**} & \multicolumn{3}{c}{**CBF-IDS**} \\ \cline{2-10}  & **Precision** & **Recall** & **F1 Score** & **Precision** & **Recall** & **F1 Score** & **Precision** & **Recall** & **F1 Score** \\ \hline Normal & 99.24 & 98.39 & 98.82 & 99.33 & 98.77 & 99.05 & 99.62 & 99.55 & **99.58** \\ DoS & 99.11 & 99.74 & 99.42 & 99.09 & 99.89 & 99.49 & 99.52 & 99.53 & **99.53** \\ Patator & 98.39 & 99.64 & 99.01 & 99.82 & 99.71 & **99.76** & 99.78 & 99.57 & 99.67 \\ PortScan & 99.38 & 99.70 & 99.54 & 99.65 & 97.98 & 98.81 & 99.68 & 99.82 & **99.75** \\ Bot & 85.93 & 73.03 & 78.95 & 93.83 & 89.06 & 91.38 & 91.97 & 96.18 & **94.03** \\ Infiltration & 100.00 & 28.57 & 44.44 & 100.00 & 71.43 & 83.33 & 100.00 & 85.71 & **92.31** \\ Web Attack & 68.40 & 90.37 & 77.87 & 72.98 & 95.41 & 82.70 & 98.61 & 97.71 & **98.16** \\ \hline \hline \end{tabular}
\end{table} 
Table 16: Performance of each class for CIC-IDS2017. Figure 9: Performance of the CNN-BiLSTM model using different loss functions on the minority class for CIC-IDS2017: (**a**) performance on the minority class Bot; (**b**) performance on the minority class Infiltration; (**c**) performance on the minority class Web Attack. time of 6.52 s. Ref. [24] follows closely with a training time of 69.22 s for one epoch and a testing time of 7.48 s. In contrast, refs. [23; 25] and CNN require less training and testing time. Table 18 shows the training and testing times for each epoch of CBF-IDS and other algorithms on the UNSW-NB15 dataset. Through Table 18, we can observe that ref. [24] has the longest training time for one epoch, reaching 163.52 s, with a testing time of 17.14 s. Next is CBF-IDS, with a training time of 127.65 s for one epoch and a testing time of 11.28 s. In comparison, refs. [23; 25] and CNN require less training and testing time. Table 19 presents the training and testing times for each epoch of CBF-IDS and other algorithms for the CIC-IDS2017 dataset. From Table 19, it can be seen that CBF-IDS has the longest training and testing times, with a training time of 118.18 s for one epoch and a testing time of 10.24 s. Next is ref. [24], with a training time of 91.00 s for one epoch and a testing time of 8.98 s. In contrast, refs. [23; 25] and CNN require relatively shorter training and testing times. From the results presented in the above tables, we can observe that CBF-IDS and ref. [24] require more runtime. Primarily, this is because CBF-IDS employs a hybrid model, including a BiLSTM layer aimed at capturing temporal features more effectively. While the authors of ref. [24] only used a BiLSTM model, they employed two layers of BiLSTM, leading to more significant time consumption. The BiLSTM model in the table has the same structure and parameter settings as the BiLSTM layer in CBF-IDS, with only one layer of BiLSTM used. It can be observed that it consumes time, ranking third in the list. As described in Section 3.3.2, BiLSTM consists of forward and backward LSTM structures, typically involving a large number of parameters. Some research results suggest that although BiLSTM models require more training time, they can provide more accurate predictive performance [57; 58]. Ref. [23] utilizes the CNN model, whereas ref. [25] employs the DNN model. Both refs.