## 4 Experimental Results and Analysis
### Results and Discussion
We also observed that the LSTM model performed poorly to detect benign flows with the degradation in the detection rate of almost 11%. We believe that the imbalanced nature of the dataset with anomaly records almost 3.2 times more than the benign records, which contributed to the degradation of the detection rate for the benign labels. Increasing the number of records for benign labels can also improve its detection rate. Figure 6: Performance of different DL-based IDS schemes in terms of FAR and FNR. Figure 7: Improvement in DNN’s performance comparing other DL-based schemes. Figure 8 shows the performance of different DL-based IDS methodology considering the different number of features selected based on the MI scores as depicted in Figure 4. We observed an almost negligible degradation in the accuracy for the DNN model for the feature sets of 80, 32, and 16. The model exhibited an almost 1% decrease in detection accuracy for 8 features set. Other DL algorithms, except for LSTM, also exhibited similar performances considering different feature sets. For LSTM, we observe the improvement of 0.7-0.8% in the accuracy considering 32 and 16 features. Since the number of features contributes to the complexity of the model. As observed, the performance remains almost similar considering the 32 and 16 features for the majority of DL algorithms. Thus, the model can be trained only using the best 16 to 32 features to reduce the complexity of the model. Figure 9 shows the confusion matrix of the proposed DNN methodology obtained for different feature sets. It was observed that anomalies are detected with more accuracy considering the 80, 32, and 16 features comparing the 8 features. At the same time, the model exhibited more incorrect predictions for the benign traffic with the 8 features set performing the worst. Furthermore, we observed that the DNN with 16 features had fewer incorrect predictions for benign labels and more incorrect predictions for anomaly labels comparing the 32 features set. The feature set selected based on MI was calculated considering the integer and float features only. Figure 8: Accuracy [%] of DL-based schemes for the different number of features. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**DL Algorithms**} & \multicolumn{3}{c}{**Anomaly**} & \multicolumn{3}{c}{**Benign**} \\ \cline{2-7}  & **Precision** & **Recall** & **F1-Score** & **Precision** & **Recall** & **F1-Score** \\ \hline
**RNN** & 98.309 & 99.643 & 98.972 & 98.848 & 94.697 & 96.728 \\
**CNN-1D** & 98.676 & 99.860 & 99.265 & 99.551 & 95.854 & 97.668 \\
**GRU** & 98.308 & 99.589 & 98.944 & 98.674 & 94.697 & 96.645 \\
**LSTM** & 96.263 & 99.096 & 97.659 & 96.925 & 88.098 & 92.301 \\
**DNN** & 98.750 & 99.956 & 99.349 & 99.859 & 96.085 & 97.936 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Performance Evaluation metrics score of individual classes [%]. To check the role of the categorical features of the dataset on the detection accuracy of the DNN, we calculated the MI scores of all of the features of the dataset. For that purpose, the categorical features were first converted as integer and binary data types which eventually increased the number of features. Figure 10 depicts the features arranged in descending order, including the categorical features as well. For experimenting, we selected all the features depicted in Figures 4 and 10 that resulted in an MI score of a minimum of 0.5 or more as given in Table 6.  
The experiment was performed again, considering the top five features to test the efficiency of all the considered DL methodologies. We observed an improvement of 0.99-3.45% in the detection accuracy for the DL-based NIDS considering the implementation with only integer and float type features, as depicted in Figure 11. The result depicts the importance of using the categorical features to improve the accuracy performance for DL-based NIDS in an IoT environment.