## 4 Results and Discussion
### Results
#### 4.1.4. SVM  
This model achieved a 99.93% accuracy rate on the CIC-MalMem-2022 dataset. According to Figure 24, the model correctly predicted 5808 malicious instances and 5798 benign instances. However, one malicious instance was incorrectly predicted as benign, and six benign instances were incorrectly predicted as malicious. For the CIC-IDS-2018 dataset, the accuracy result was 97.41%. Based on Figure 25, the confusion matrix shows that the model correctly predicted 1976 malicious and 4390 benign instances. However, 41 malicious instances were incorrectly predicted to be benign, and 128 benign instances were incorrectly predicted as malicious. In the CIC-IDS-2017 dataset, accuracy was achieved at 94.04% by this model, and the confusion matrix in Figure 26 indicates that the model incorrectly predicted 741 malicious samples as benign and 54 benign samples as malicious. For the CIC-MalMem-2022 dataset, the learning curve, as shown in Figure 27, indicates that as the number of training examples increases, the training score rises. The training score starts at 99.88%, a little higher than the cross-validation score, which begins at 99.84% accuracy; however, the cross-validation score decreases after 40,000 samples. As shown in Figure 28, the training and cross-validation scores for the CIC-IDS-2018 dataset increase with the increase in training examples. Nevertheless, the cross-validation score plateaus after a certain point, whereas the training score continues to increase. The learning curve for the CIC-IDS-2017 dataset in Figure 29 indicates that the training score increases with the  
Figure 23. Learning curve for Stacking classifier on CIC-IDS-2017 dataset.  
Figure 22. Learning curve for Stacking classifier on CIC-IDS-2018 dataset.  
number of training examples because the classifier becomes more proficient at analyzing the data as more samples are viewed. However, the cross-validation score plateaus after a certain number of examples. This results in the classifier needing help to learn from the data, and the additional training examples do not improve the classifier's performance. For the SVM model, the regularization parameter (C) is a very important parameter. As the value of the parameter increases, the classification accuracy improves (or the regression error is reduced); however, overfitting may also occur. In this model, five different values were assigned to C: 0.1, 0.9, 10.0, 50.0, and 100.0. As shown in Figure 30, the best parameter was 50.0 for the CIC-MalMem-2022 dataset. Furthermore, the best parameter value for the CIC-IDS-2018 dataset was 100, with a mean test score of 98.31%, as shown in Figure 31, and the mean score time was 0.34 s. Also, the best parameter for the CIC-IDS-2017 dataset was 100, as shown in Figure 32. The mean score for this dataset was 97.20%, and the mean score time was 1.17 s.  
Figure 24: Confusion matrix for SVM on CIC-MalMem-2022 dataset.  
Figure 25: Confusion matrix for SVM on CIC-IDS-2018 dataset.  
Figure 28: Learning curve for SVM on CIC-IDS-2018 dataset.  
Figure 27: Learning curve for SVM on CIC-MalMem-2022 dataset.  
Figure 26: Confusion matrix for SVM on CIC-IDS-2017 dataset.  
Figure 31: Hyperparameter tuning for SVM on CIC-IDS-2018 dataset.  
Figure 30: Hyperparameter tuning for SVM on CIC-MalMem-2022 dataset.  
Figure 29: Learning curve for SVM on CIC-IDS-2017 dataset.