## 4 Results and Discussion
### Performance of Machine and Deep Learning Models  
Experimental results for machine and deep learning models are presented in Table 5. It can be noticed that traditional machine learning models like RF, LR, and SVM have low accuracy scores than RFMLP for the four attack types. In particular, for the R2L attack  
Figure 2: Architecture of the proposed RFMLP model for DDoS attack detection. type, the accuracy of RF, SVM, and LR models is significantly lower than MLP and RFMLP models. In addition, LR shows poor performance than the other three models in terms of accuracy. RFMLP has the highest accuracy among all other three models on KDD-CUP 99. The prediction accuracy of RF, SVM, and LR for the R2L attack type is lower than other attack types while RFMLP predicts R2L effectively with a 99.99% on KDD-CUP 99. Table 6 presents the results for the NSL-KDD dataset for all models. Results indicate that RFMLP outperforms all other models with a significant difference. The performance of RF, SVM, and LR is severely affected by the U2R attack type. Similarly, their performance for R2L attacks is also comparatively poor than DoS and Prob attack types. RFMLP, on the other hand, achieves 100% for DoS and U2R while for Prob and R2L attack types, and its accuracy is 99.98% and 99.97%, respectively. The performance of all models using the STIN dataset is shown in Table 7 which indicates the RFMLP shows superior performance than all other models. For the UDP_DoS attack type, it obtains a 100% accuracy while its performance is affected for the Syn_DDoS attack type. However, its performance is much better than RF, SVM, LR, and MLP, which obtain 86.18%, 83.37%, 83.42%, and 88.65%, respectively for the same attack type. Table 8 provides the classification results using the STIN terrestrial dataset. Results suggest that the proposed model performs very well by combining RF and MLP. Although a slightly lower performance is observed for 'Portmap DDoS', and 'LDAP DDoS' classes with 91.21% and 93.14% accuracy scores, respectively, the overall performance is substantially better than other machine learning models. The low performance for these classes is on account of the low number of samples available for training. Table 9 presents the performance comparison of RF, SVM, LR, MLP, and RFMLP on all three datasets in terms of accuracy, precision, recall, and F1 score. For traditional models, deep learning-based MLP outperforms the other models in terms of all evaluation measures. However, the performance of the RFMLP is even better than the MLP which shows its significance. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Attack Type** & **RF** & **SVM** & **LR** & **MLP** & **RFMLP** \\ \hline DoS & 99.93 & 98.82 & 91.96 & 100.0 & 100.0 \\ Prob & 98.18 & 97.73 & 94.68 & 99.65 & 99.98 \\ R2L & 97.06 & 96.94 & 95.38 & 99.79 & 99.97 \\ U2R & 94.40 & 96.64 & 95.55 & 99.88 & 100.0 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Accuracy of classifiers on NSL-KDD dataset. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Attack Type** & **RF** & **SVM** & **LR** & **MLP** & **RFMLP** \\ \hline UDP\_Dos & 89.45 & 86.18 & 86.66 & 92.17 & 100.0 \\ Syn\_DDoS & 86.18 & 83.37 & 83.42 & 88.65 & 93.18 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Accuracy of classifiers on STIN satellite dataset. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Attack Type** & **RF** & **SVM** & **LR** & **MLP** & **RFMLP** \\ \hline DoS & 99.82 & 99.28 & 96.44 & 99.99 & 100.0 \\ Prob & 99.12 & 99.34 & 98.89 & 99.98 & 99.99 \\ R2L & 97.21 & 97.34 & 97.01 & 99.26 & 99.99 \\ U2R & 99.16 & 99.29 & 99.07 & 99.89 & 99.99 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Accuracy of classifiers on KDD-CUP 99 dataset. STIN security dataset consists of different types of attacks from terrestrial and satellite networks.