## 4 Experiments and Their Outcomes
### Answer to First RQ  
RQ1: _\"How can the CNN + BiLSTM hybrid DL model predict DDoS attacks based on benchmark data set?\"_ can be answered by applying different parameters to the DL model and utilizing various CNN + BiLSTM models to forecast DDoS attacks using benchmark data. We performed some tests using various parameters. The parameters for the proposed CNN-BiLSTM model are given in Table 3.  
Figure 4: DDoS attack prediction output.  
In accordance with Table 5, it is noticed that the CNN-BiLSTM model \"CNN-BiLSTM (10)\" with a filter size of 8 \(\times\) 8, a filter count of 16, and a BiLSTM unit size of 10 (neurons) outperforms all other models with a 76 percent accuracy. The various models are listed in ascending order of their test accuracy, which ranges from 85% to 94%. After completing several tests on various CNN-BiLSTM models with variable parameters, we recorded the test accuracy, test loss, and training time. Table 5 summarizes the training duration, test accuracy, and test loss for all 10 trials using various parameter values in the CNN + BiLSTM model.  
By varying the parameters of the DL model, we discovered that reducing the unit size of the BiLSTM model leads to increased accuracy. In other words, the CNN + BiLSTM-10 model with feature selection performed best (91.52 percent) with smaller unit sizes.  
During testing, it was discovered that the CNN-BiLSTM (10) model, which had a total of 16 filters, an average filter size of 8, and a BiLSTM unit size of 10 (neurons), outperformed all other models by 76 percent. The training time of the model is enhanced by reducing the filter size.  
\begin{table}
\begin{tabular}{l l l l l l l} \hline \hline
**Model Name** & **\# of Filters** & **Unit Size of BiLSTM** & **Size of Filter** & **Model Name** & **\# of Filters** & **Unit Size of BiLSTM** & **Size of Filter** \\ \hline CNN-BiLSTM (1) & 6 & 20 & 7 & CNN-BiLSTM (2) & 6 & 45 & 7 \\ \hline CNN-BiLSTM (3) & 6 & 40 & 8 & CNN-BiLSTM (4) & 10 & 20 & 8 \\ \hline CNN-BiLSTM (5) & 10 & 40 & 10 & CNN-BiLSTM (6) & 10 & 35 & 10 \\ \hline CNN-BiLSTM (7) & 10 & 60 & 10 & CNN-BiLSTM (8) & 10 & 45 & 10 \\ \hline CNN-BiLSTM (9) & 9 & 20 & 10 & CNN-BiLSTM (10) & 16 & 10 & 8 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Parameterization for 10 different CNN + BiLSTM models.  
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**Parameter** & **Value** & **Parameter** & **Value** \\ \hline vocabulary size & 1000 & Embedding dimension & 128 \\ Input vector size & 53 to 60 & Unit size of BiLSTM & 65, 45, 40, 35, 20, 15, 10 \\ \# of convolutional layers & 1 & \# of hidden layers & 4 \\ \# of filters & 6, 9, 10, 16 & size of filters & 7, 8, 10 \\ Dropout & 0.9 & Activation function & Softmax \\ \# of epochs & 7 & size of batch & 8, 16 \\ \hline \hline \end{tabular}
\end{table}
Table 3: CNN-BiLSTM model parameterization.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Model Name** & **Test Accuracy** & **Test Loss** & \
\begin{tabular}{c} **Unit Size** \\ **(BiLSTM)** \\ \end{tabular} &
\begin{tabular}{c} **Training Time** \\ **(s)** \\ \end{tabular} \\ \hline CNN + BiLSTM-1 & 85.11\% & 0.81 & 65 & 7 s \\ CNN + BiLSTM-2 & 86.01\% & 0.86 & 45 & 13 s \\ CNN + BiLSTM-3 & 86.52\% & 1.06 & 40 & 21 s \\ CNN + BiLSTM-4 & 87.46\% & 1.16 & 40 & 10 s \\ CNN + BiLSTM-5 & 87.77\% & 0.95 & 35 & 11 s \\ CNN + BiLSTM-6 & 91.46\% & 0.93 & 35 & 6 s \\ CNN + BiLSTM-7 & 92.00\% & 1.13 & 20 & 13 s \\ CNN + BiLSTM-8 & 92.05\% & 0.82 & 15 & 10 s \\ CNN + BiLSTM-9 & 93.10\% & 0.92 & 10 & 13 s \\ CNN + BiLSTM-10 & 94.52\% & 0.81 & 10 & 29 s \\ \hline \hline \end{tabular}
\end{table}
Table 5: The tested CNN + BiLSTM models’ test accuracy, test loss, and training time.