## 5 Experiments and Analysis of Results
### Risk-Aware Decision System Results  
In the second part of the experiment, we evaluated the effectiveness of the proposed intrusion detection and response system in reducing risk levels. Figure 9 shows the distribution of risk scores across all samples, with the X-axis representing risk scores (0-100) and the Y-axis (logarithmic scale) indicating sample counts. The histogram reveals a clear skew toward low-risk values, with a large concentration of samples in the 0-5 range. The logarithmic scale helps better visualize the relatively small number of high-risk samples  
Figure 8: False-positive rate and false-negative rate for multi-class detection. Figure 7: Comparison of the DOA-BPNN with other optimization algorithm in binary classification. (scores above 75), which, although rare, require critical security attention. This pattern reflects a typical real-world network scenario, where most traffic is benign, but a minority of events pose significant risks. Figure 10 compares risk level distributions before and after applying the Bayesian risk scoring module. In subfigure (a), risk levels are assigned based solely on raw detection results, causing over 34% of samples to be misclassified as high risk and less than 2% to fall into medium or extreme categories. Subfigure (b) demonstrates the refined distribution after Bayesian evaluation, where the majority of samples are accurately classified as low risk (74.5%), and high-confidence threats are reassigned to medium and extreme categories (10.7% and 11.5%, respectively), aligning better with the true risk profile. This demonstrates that Bayesian scoring improves precision in risk categorization, enhancing the system's capability for adaptive defense. To comprehensively evaluate the proposed security framework, we designed three different security configurations that represent increasing levels of defense sophistication:  
1. Rule-based Defense: This configuration uses the DOA-BP detection model to identify attacks. It directly converts anomaly scores into risk scoring and applies basic rule-based responses, without any Bayesian risk scoring or reinforcement learning. This setup represents a typical approach used in traditional security systems. 2. Bayesian Risk Scoring: This configuration builds on the rule-based defense scenario by integrating Bayesian risk scoring for more accurate risk evaluation. The DOA-BP detection model remains the same, but the addition of Bayesian risk scoring leads to  
Figure 10: Comparison of risk level distributions under different evaluation mechanisms: (**a**) classification without Bayesian Scoring; (**b**) classification after Bayesian scoring. Figure 9: Risk score distributions of samples. better risk identification and more precise risk evaluation compared to the rule-based defense scenario. 3. Full Defense: This configuration extends the Bayesian risk scoring scenario by incorporating an RL-based response module. The Bayesian risk model evaluates risks based on attack type impact, detection confidence, and environmental factors, while the RL module dynamically selects optimal defense actions based on the assessed risk, offering a more adaptive and context-aware defense system. In each scenario, we measure risk scores at two critical points:
* Pre-Defense: The risk score calculated immediately after an attack is detected, before any defensive action is applied. This reflects the initial severity of the detected threat. * Post-Defense: The risk score measured after applying the corresponding defense action. This shows how effectively the defense reduces the risk. Importantly, while the defensive actions are the same across all scenarios, as defined in Table 4, the method of selecting these actions differs. In the rule-based defense and Bayesian risk scoring scenarios, actions are selected based on fixed rule mappings from risk levels (e.g., low, medium, high, critical); in the Full Defense scenario, the RL module dynamically determines the optimal action based on a broader context.