## 4 Experimental Results and Analysis
### UNSW-NB15 Results and Analysis  
We conducted a comprehensive evaluation of CBF-IDS's detection capabilities against novel attacks on the UNSW-NB15 dataset, comparing it with other algorithms. The experimental findings demonstrate that CBF-IDS surpasses other algorithms in all metrics, achieving an F1 score of 79.61%. Table 11 presents a detailed overview of the multi-classification performance of CBF-IDS and other algorithms on the UNSW-NB15 dataset, highlighting the best metrics in bold. Table 11 presents the performance of CBC-IDS, CBA-IDS, and CBF-IDS on UNSW-NB15. These models share the same CNN-BiLSTM structure but are integrated with different loss functions. It can be observed that CBF-IDS, which employs the focal loss function, outperforms other loss functions. In Table 12, a performance comparison of different model structures in the multi-classification on UNSW-NB15 is provided. The best metrics are highlighted in bold. With an increase in the number of convolutional layers, CNN models exhibit improved performance in multi-classification. Additionally, within the CNN-BiLSTM hybrid model, we observe that models integrating BiLSTM outperform pure CNN models without BiLSTM integration, with the same number of convolutional layers, in multi-classification. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Class**} & \multicolumn{3}{c}{**CBC-IDS**} & \multicolumn{3}{c}{**CBA-IDS**} & \multicolumn{3}{c}{**CBF-IDS**} \\ \cline{2-10}  & **Precision** & **Recall** & **F1 Score** & **Precision** & **Recall** & **F1 Score** & **Precision** & **Recall** & **F1 Score** \\ \hline DoS & 99.81 & 99.88 & 99.85 & 99.81 & 99.94 & **99.88** & 99.85 & 99.91 & **99.88** \\ Normal & 99.24 & 98.94 & 99.09 & 99.24 & 99.33 & 99.29 & 99.46 & 99.47 & **99.46** \\ Probe & 98.24 & 99.04 & 98.64 & 99.11 & 98.72 & 98.91 & 99.25 & 99.15 & **99.20** \\ R2L & 86.51 & 90.14 & 88.29 & 91.53 & 90.54 & 91.03 & 92.98 & 93.11 & **93.05** \\ U2R & 66.67 & 25.00 & 36.36 & 66.67 & 41.67 & 51.28 & 77.78 & 58.33 & **66.67** \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Performance of each class for NSL-KDD. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Algorithm** & **Accuracy** & **Precision** & **Recall** & **F1 Score** \\ \hline SVM & 76.88 & 74.49 & 76.88 & 72.31 \\ KNN & 76.48 & 76.13 & 76.48 & 76.17 \\ [23] & 79.06 & 79.77 & 79.06 & 78.58 \\ [24] & 79.05 & 78.18 & 79.05 & 75.88 \\ [25] & 80.02 & 79.22 & 80.02 & 78.80 \\
[27] & 80.93 & - & - & 78.08 \\ CBC-IDS & 81.31 & 80.48 & 81.31 & 78.32 \\ CBA-IDS & 81.67 & 82.25 & 81.67 & 78.69 \\ CBF-IDS & **82.30** & **82.76** & **82.30** & **79.61** \\ \hline \hline \end{tabular}
\end{table} 
Table 11: Performance of multi-classification for UNSW-NB15. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Model** & **Layer** & **Accuracy** & **Precision** & **Recall** & **F1 Score** \\ \hline \multirow{4}{*}{CNN} & 1 Conv & 76.31 & 74.43 & 76.31 & 74.30 \\  & 2 Conv & 79.48 & 77.86 & 79.48 & 76.91 \\ \cline{1-1}  & 3 Conv & 80.94 & 80.76 & 80.94 & 78.25 \\ \cline{1-1} BiLSTM & 1 BiLSTM & 80.29 & 79.79 & 80.29 & 77.12 \\ \cline{1-1}  & 1 Conv + 1 BiLSTM & 80.52 & 79.02 & 80.52 & 78.33 \\ \cline{1-1} CNN-BiLSTM & 2 Conv + 1 BiLSTM & 81.36 & 81.61 & 81.37 & 79.00 \\ \cline{1-1}  & 3 Conv + 1 BiLSTM * & **82.30** & **82.76** & **82.30** & **79.61** \\ \hline \hline \end{tabular}
\end{table} 
Table 12: Multi-classification performance of different model structures for UNSW-NB15. The performance of the CNN-BiLSTM model using three different loss functions (CE, \(\alpha\)-balanced CE, and focal loss) on different classes is presented in Table 13. The best F1 scores are highlighted in bold. These results demonstrate that CBF-IDS, when using focal loss, achieves the highest F1 score across all network traffic types. Figure 8a illustrates that CBF-IDS attains a precision of 59.10%, a recall of 65.56%, and an F1 score of 62.17% on the minority class Shellcode.