# Image-Based Malicious Network Traffic Detection Framework: Data-Centric Approach
## 4 Experimental Results
### Effectiveness of Feature Engineering
The small standard deviations observed across accuracy measurements (\(\sigma\leq 0.0014\)), loss metrics, training times, and inference times indicate that the performance improvements are consistent and not due to random variations in model initialization. The boxplots further demonstrate that even in experimental runs with the lowest observed performance (worst-case scenarios), our model with dimensionality reduction consistently outperforms the dimensionality-reduction-free model across most metrics. \begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Metric**} & **Dimensionality** & **Dimensionality Reduction-Free** \\  & **Reduction (Mean \(\pm\) Std)** & **(Mean \(\pm\) Std)** \\ \hline Accuracy (Train) & \(0.9946\pm 0.00051\) & \(0.9938\pm 0.00080\) \\ Accuracy (Validation) & \(0.9909\pm 0.00101\) & \(0.9890\pm 0.00140\) \\ Accuracy (Test) & \(0.9906\pm 0.00099\) & \(0.9898\pm 0.00116\) \\ Loss (Train) & \(0.01397\pm 0.00128\) & \(0.01604\pm 0.00209\) \\ Loss (Validation) & \(0.04132\pm 0.00542\) & \(0.04154\pm 0.00384\) \\ Training Time (s) & \(764.66\pm 32.53\) & \(926.47\pm 21.34\) \\ Testing Time (s) & \(2.99\pm 0.33\) & \(3.71\pm 0.43\) \\ \hline \hline \end{tabular} Note.: The unit “s” denotes seconds.  
\end{table} 
Table 10: Mean and standard deviation of model performance metrics (10 runs). Figure 10: The comparison of model training time. In conclusion, the proposed framework showed high classification accuracy and fast model training and testing time. These results demonstrate that the framework can achieve significant performance improvement in real-time malicious network traffic detection in IDSs. Figure 11: Boxplots comparing performance metrics across 10 experimental runs for models with and without dimensionality reduction. (**a**) Accuracy; (**b**) Validation Accuracy; (**c**) Test Accuracy; (**d**) Training Loss; (**e**) Validation Loss; (**f**) Training Time; (**g**) Testing Time. To comprehensively evaluate our dimensionality reduction approach, we compared our framework with existing studies that employed various dimensionality reduction techniques on intrusion detection datasets, as summarized in Table 11.  
Our approach demonstrates several notable advantages when considering the holistic trade-offs between dimensionality reduction extent, accuracy, and computational efficiency. First, a key strength of our approach is achieving superior classification accuracy (99.06%) with only minimal dimensionality reduction (12.2%, from 41 to 36 features, as shown in the 'Red. (%)' column). This minimal reduction, unlike studies applying substantial feature reduction (ranging from 49.0% to 94.3% in Table 11), prioritizes preserving the original information content. This strategic feature selection contributed to our model's high accuracy (99.06%), which outperformed other NSL-KDD-based approaches, such as those of [PERSON] et al. [62] (96.12%), [PERSON] et al. [58] (80.60%), and [PERSON] et al. [60] (85.73%) in terms of 'Acc. After'. Furthermore, another significant strength is the balanced improvement across multiple performance facets: our framework exhibits substantial reductions in both training time (approx. 17.47%; Train Time \(\Delta\) (%)') and inference time (approx. 19.44%; 'Infer. Time \(\Delta\) (%)') while simultaneously maintaining, and even slightly improving, classification accuracy (+0.08% 'Acc. \(\Delta\)'). This positive 'Acc. \(\Delta\)' contrasts sharply with the weaknesses observed in several other approaches where accuracy degradation was a notable trade-off. For instance, studies by [PERSON] et al. [54], [PERSON] et al. [66], and [PERSON] et al. [68] reported accuracy degradations ('Acc. \(\Delta\)' values of \(-0.20\%\), \(-0.26\%\), and \(-0.30\%\), respectively) after applying their DR techniques. Regarding computational efficiency, while our method shows significant improvements, some studies present different trade-off profiles. For example, [PERSON] et al. [62] and [PERSON] et al.