## 4 Results and Discussion
### Security Analysis Using an Adversarial Attack Model
#### 4.2.2 Attack Generation and Preprocessing of Generated Attack Data
The XGBoost model was already evaluated on the CIC-IDS-2018 dataset and had an accuracy of 99.73% and a test time of 0.03 s. According to our evaluation, the XGBoost model's detection accuracy on adversarial data without training on adversarial data ranges from 99.57% in detecting brute force attacks to 99.63% in detecting port scanning and malware attacks. We can observe that the accuracy is almost the same and the model keeps its ability to detect new attacks. The second test method involved retraining the model by using the simulated attack data, which is required in the case of a significant change in data distribution. The results are depicted in Table 10. \begin{table}
\begin{tabular}{l c c} \hline \hline
**Adversarial Attack** & **Accuracy** & **Test Time** \\ \hline DoS/DDoS & 99.61\% & 0.02 s \\ Brute force & 99.57\% & 0.03 s \\ Port scanning & 99.63\% & 0.02 s \\ Malware & 99.63\% & 0.02 s \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Performance metrics for adversarial attack detection without retraining the model on adversarial data. Table 10 shows an accuracy in detection of 99.75%, which outperforms even the accuracy detection rate on the original data, which is 99.73%. The confusion matrix in Figure 51 indicates that the model correctly predicted 1561 malicious and 4449 benign instances. Fourteen instances were incorrectly predicted as malicious, and one was incorrectly predicted as benign. According to the results, it is clear that the model has the ability to detect new attacks while keeping high accuracy and a low false positive rate, which ensures the model's robustness. Of course, in the case of an infrastructure change, such as adding new devices or changing the network topology, the model must be retrained based on the new data distribution to keep a high detection rate. ### Discussion

According to Tables 11-13, and the requirement of the proposed architecture, the fastest model to detect malicious instances is XGBoost, while Stacking gives the highest accuracy in detecting malicious instances. Also, the Stacking model has fewer FNs for all datasets. XGBoost exhibits high accuracy, recall, precision, and F1-score across all datasets, with very low test time. The Stacking approach achieves the highest accuracy and F1-score in some cases. Additionally, it achieves high recall and precision, but it has a longer test time. Due to the importance of test time in this study, the experiment conducted by [34; 37] was re-conducted to determine the test time. A comparison of this study's results and other studies is shown in Tables 14-16 for each dataset used in this study. This study achieved 99.96% accuracy on the CIC-MalMem-2022 dataset within 0.01 s, while [34] obtained 100% accuracy with a time of 0.08 s, which is higher than this study. Based on the CIC-IDS-2018 and CIC-IDS-2017 datasets, this study achieves greater accuracy and lower time than [24; 37]. In other studies, there is no global centralized traffic inspection before traffic is distributed to the sub-networks of an organization, as instead occurs with a multi-model IDS based on the traffic load. The proposed architecture involves two layers of security. The multi-model IDS in the first layer inspects the organization's incoming traffic quickly. In contrast, the IDSs in \begin{table}
\begin{tabular}{l c c} \hline
**Adversarial Attacks** & **Accuracy** & **Test Time** \\ \hline Combined data & 99.75\% & 0.03 s \\ \hline \end{tabular}
\end{table} 
Table 10: Performance metrics for adversarial attack detection using trained model on adversarial data. Figure 51: Confusion matrix trained on both the CIC-IDS-2018 dataset and the simulated attack data for XGBoost. the sub-networks of the organization act as second-layer security, which can more accurately detect attacks. This research study aims to analyze traffic behavior and patterns; each network traffic has IP addresses, protocols, and packet sizes.