## 4 Results and Discussion
### Security Analysis Using an Adversarial Attack Model
#### 4.2.2 Attack Generation and Preprocessing of Generated Attack Data
While this study was evaluated by using specific datasets, the proposed architecture of a multi-model IDS based on traffic load was designed to be adaptable to different scenarios. Additionally, the proposed architecture allows organizations to monitor incoming traffic and encrypt sensitive data while restricting access to authorized users only. The percentage of accuracy of the ML-based IDS for different organizations depends on the nature of an organization's data. If the data for a specific organization are private and sensitive, the risk becomes high. In this situation, the organization should focus on high accuracy despite the higher computational cost. On the other hand, if the data are not sensitive and are normal, the risk is lower. It is important to note that false positives and false negatives have different consequences based on the environment, circumstances, and current situation. False positives lead to unnecessary costs, and the model cannot distinguish between normal and malicious traffic. False negatives lead to high risk, so high accuracy is very important. By understanding the trade-offs between accuracy and computational cost, organizations can improve their systems to reduce risk. \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Algorithm** & **Accuracy** & **Precision** & **Recall** & **F1-Score** & **Test Time** \\ \hline AdaBoost & 99.11\% & 99.37\% & 97.86\% & 98.61\% & 0.08 s \\ Voting & 99.58\% & 100\% & 98.71\% & 99.35\% & 2.20 s \\ Stacking & 99.61\% & 99.66\% & 99.13\% & 99.40\% & 1.64 s \\ SVM & 97.41\% & 97.96\% & 93.91\% & 95.89\% & 1.56 s \\ RF & 99.64\% & 99.90\% & 98.99\% & 99.44\% & 0.10 s \\ XGBoost & 99.73\% & 99.95\% & 99.23\% & 99.59\% & 0.03 s \\ \hline \hline \end{tabular}
\end{table} 
Table 13: CIC-IDS-2017 dataset analysis. \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Algorithm** & **Accuracy** & **Precision** & **Recall** & **F1-Score** & **Test Time** \\ \hline AdaBoost & 99.94\% & 99.96\% & 99.93\% & 99.94\% & 0.10 s \\ Voting & 99.96\% & 99.98\% & 99.94\% & 99.96\% & 2.27 s \\ Stacking & 99.98\% & 99.98\% & 99.98\% & 99.98\% & 2.90 s \\ SVM & 99.93\% & 99.89\% & 99.98\% & 99.93\% & 0.44 s \\ RF & 99.98\% & 99.98\% & 99.98\% & 99.98\% & 0.11 s \\ XGBoost & 99.96\% & 99.98\% & 99.94\% & 99.96\% & 0.01 s \\ \hline \hline \end{tabular}
\end{table} 
Table 11: CIC-MalMem-2022 dataset analysis. \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Algorithm** & **Accuracy** & **Precision** & **Recall** & **F1-Score** & **Test Time** \\ \hline AdaBoost & 99.11\% & 99.37\% & 97.86\% & 98.61\% & 0.08 s \\ Voting & 99.58\% & 100\% & 98.71\% & 99.35\% & 2.20 s \\ Stacking & 99.61\% & 99.66\% & 99.13\% & 99.40\% & 1.64 s \\ SVM & 97.41\% & 97.96\% & 93.91\% & 95.89\% & 1.56 s \\ RF & 99.64\% & 99.90\% & 98.99\% & 99.44\% & 0.10 s \\ XGBoost & 99.73\% & 99.95\% & 99.23\% & 99.59\% & 0.03 s \\ \hline \hline \end{tabular}
\end{table} 
Table 12: CIC-IDS-2018 dataset analysis. Our multi-model IDS based on traffic load employs a combination of signature and behavior-based detection to address known and unknown threats. Signature-based detection is effective in detecting known patterns of attacks. On the other hand, the behavior-based detection approach analyzes the deviation from normal traffic. It is, therefore, capable of detecting zero-day exploits and Advanced Persistent Threats (APTs) that are not matched by existing signatures. In the case of a change in the organization's network topology and device types or a huge change in traffic, the model must be retrained on the new data after the change. Generally, organizations do not frequently change their network infrastructure, so the update rate of the model will not be frequent. Limitations of Proposed Model

The multi-model based IDS was tested on a dataset using real traffic (CIC-IDS-2018) and on another using simulated traffic (CIC-IDS-2017).