# Deep Feature Fusion via Transfer Learning for Multi-Class Network Intrusion Detection
## 5 Results
### Comprehensive Performance Analysis of the Proposed Method
Notably, the performance of the CNN + Attention (TL) model decreased to 92.99%, and the CNN + Attention (NoTL) model declined further to 92.33%, indicating that the absence of feature fusion and transfer learning leads to significant performance degradation. Conversely, the proposed model exhibited relatively stable performance. A comprehensive analysis of the experimental results from Tables 5 and 6 indicates that the proposed model maintains high classification performance even as the training data decreases. This result demonstrates that the proposed approach can minimize performance degradation even in situations with limited data availability by effectively leveraging the feature representations of pre-trained models. Additionally, it confirms that the model can sustain high generalization performance even in new data environments, such as previously unseen attack types. Notably, compared to traditional CNN-based models, the proposed model significantly improves robustness to data reduction by effectively adjusting initial weight configurations through transfer learning and optimizing information from various feature maps through feature fusion. Figure 7 presents a confusion matrix that visualizes the model's prediction results for each attack type, providing an intuitive comparison between actual and predicted \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Model** & **Train 100\%** & **Train 66\%** & **Train 33\%** \\ \hline KNN & 94.05 & 93.58 & 92.92 \\ LR & 90.77 & 90.64 & 90.29 \\ SVM & 91.84 & 91.59 & 91.14 \\ CNN(NoTL) & 92.63 & 92.33 & 91.25 \\ CNN + Attention (NoTL) & 93.64 & 93.27 & 92.33 \\ CNN + Attention (TL) & 93.90 & 93.70 & 92.99 \\ Proposed model & 94.16 & 94.05 & 93.59 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: F1-score evaluation of models with 100%, 66%, and 33% training data. classifications. In Figure 7a, the CNN (NoTL) model, which does not incorporate transfer learning or feature fusion, demonstrates lower classification performance for some attack types compared to the proposed model in Figure 7b. For example, in the Benign type, the CNN (NoTL) model correctly classified 250 out of 251 instances, while the proposed model classified 249 correctly. For the DDoS type, the CNN (NoTL) model correctly predicted 243 out of 250 instances, whereas the proposed model demonstrated improved performance by correctly predicting 249 instances. For the DoS type, the CNN (NoTL) model accurately classified 189 instances, while the proposed model correctly classified 191 instances. Meanwhile, both models performed equally in classifying FTP-Patator and SSH-Patator attack types, accurately predicting 235 out of 251 and 251 out of 251 instances, respectively. However, for the Bot attack type, which is a new attack type introduced in the target domain visually highlighted with a red circle, the CNN (NoTL) model correctly classified 237 out of 251 instances. In contrast, the proposed model outperformed with 250 correct classifications, demonstrating superior performance. These results experimentally confirm that transfer learning and feature fusion effectively classify new attack types.