## 4 Performance Evaluation and Comparison
### Results and Comparison
#### 4.2.4 Overall Comparison  
Figure 9 illustrates the loss curves for each dataset during the training process. Early stopping was applied to determine the optimal number of epochs for each dataset, with the CICIDS2017 dataset stopping at epoch 80, the NSL-KDD dataset at epoch 350, and the UNSW-NB15 dataset at epoch 78. The loss curves indicate the convergence of the model during training, and the early stopping ensures the prevention of overfitting. Figure 8: ROC curve for UNSW-NB15 dataset. Figure 9: Loss curves for each dataset during the training process. Additionally, Figure 10 showcases a bar plot comparing the accuracy, precision, recall, and F1-score achieved by our LSTM-based IDS across the three datasets: CICIDS2017, NSL-KDD, and UNSW-NB15. The bar plot visually illustrates the superior performance of our intrusion detection model in all metrics, as evidenced by the prominently displayed values for each dataset. The remarkable results further validate the effectiveness and robustness of our proposed approach in accurately detecting network intrusions across diverse real-world scenarios. Furthermore, Table 5 offers a comprehensive comparison of the evaluation metrics for each dataset. The table highlights the performance of our LSTM-based IDS in terms of accuracy, precision, recall, and F1-score, allowing for an easy comparison between the datasets. Overall, the results demonstrate the effectiveness and robustness of our LSTM-based IDS in accurately detecting network intrusions across diverse real-world scenarios. The model exhibits exceptional performance across all three datasets, validating its capability to handle varying levels of complexity and imbalanced data. The superiority of our proposed IDS is evident, offering promising potential for real-world deployment in network security applications. The Focus on the LSTM Model:  
Our decision to utilize the long short-term memory (LSTM) model was driven by its well-established ability to effectively model sequential data, making it particularly suitable for intrusion detection in network traffic where the order of events is crucial. LSTM's recurrent architecture enables it to capture and learn intricate patterns and dependencies from data traffic, which can be challenging for traditional machine learning models. Additionally, LSTM has shown promising results in previous intrusion detection research, further motivating its inclusion in our study. Consideration of Other Models:  
While our primary focus was on LSTM due to its sequential data modeling capabilities, we acknowledge the existence of other recently developed machine learning models reported in the literature. These models, including deep learning architectures and ensemble methods, have indeed shown promise in various applications. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset** & **Accuracy** & **Precision** & **Recall** & **F1-Score** \\ \hline CICIDS2017 & 99.34\% & 99.34\% & 99.34\% & 99.34\% \\ \hline NSL-KDD & 99.75\% & 99.56\% & 99.94\% & 99.75\% \\ \hline UNSW-NB15 & 98.31\% & 97.87\% & 98.74\% & 98.30\% \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Performance comparison of LSTM-based IDS on three datasets. Figure 10: A bar plot comparing the accuracy. Justification for Future Work:  
In our research, we opted for a focused approach to thoroughly investigate the potential of LSTM-based intrusion detection, particularly in the context of IoT networks. However, we recognize the importance of considering and comparing other state-of-the-art machine learning models in future work. This would allow for a more comprehensive evaluation of various approaches and their suitability for different intrusion detection scenarios. Future Research Directions:  
As part of future research directions, we plan to explore the integration and comparison of multiple machine learning models, including recently developed ones, to further enhance the performance and robustness of our intrusion detection system.