# A Complete EDA and DL Pipeline for Softwarized 5G Network Intrusion Detection
## 5 Experimental Results and Discussion
### DL-Based Framework's Results and Discussion
#### 5.4.2 Multi-Class Classification Scenario
To further study the capabilities of the DL models in detecting the different attacks, Figures 14-16 provide the confusion matrices for the dense autoencoder neural network, convolutional neural network, and recurrent neural network models, respectively. These figures provide insights into the detection capabilities of the DL models when it comes to detecting specific attacks. Most of the misclassification cases occurred between specific pairs of attack types that exhibited similar characteristics. For instance, the HTTPFlood attack mimics human behavior by generating a large volume of seemingly legitimate requests, which can lead to confusion with other attack types. Similarly, in SlowRateDOS attacks, a large volume of malicious activities occur, but at a slower pace. This potentially causes \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Model** & **Attack Type** & **Overall Accuracy** & **Precision** & **Recall** & **F1-Score** \\ \hline \multirow{8}{*}{Dense Autoencoder Neural Network} & Benign & 0.99974 & 0.99998 & 0.99988 \\  & HTTP Flood & 0.99094 & 0.99573 & 0.99334 \\  & ICMP Flood & 0.98854 & 1.00000 & 0.99423 \\  & SYN Flood & 0.99283 & 0.85521 & 0.91892 \\  & SYN Scan & 0.9975 & 0.99663 & 0.99734 & 0.99702 \\  & Slowrate DoS & 0.99667 & 0.99733 & 0.99700 \\  & TCP Connect Scan & 0.93626 & 0.99634 & 0.96537 \\  & UDP Flood & 1.00000 & 1.00000 & 1.00000 \\  & UDP Scan & 0.99706 & 0.99664 & 0.99685 \\ \hline \multirow{8}{*}{Convolutional Neural Network} & Benign & 0.9993 & 0.9999 & 0.9996 \\  & HTTP Flood & 0.9612 & 0.9975 & 0.9790 \\  & ICMP Flood & 0.9958 & 1.0000 & 0.9979 \\  & SYN Flood & 0.9958 & 0.9984 & 0.9971 \\  & SYN Scan & 0.9984 & 0.9992 & 0.9962 & 0.9977 \\  & Slowrate DoS & 0.9949 & 0.9907 & 0.9928 \\  & TCP Connect Scan & 0.9968 & 0.9983 & 0.9975 \\  & UDP Flood & 0.9999 & 0.9993 & 0.9996 \\  & UDP Scan & 1.0000 & 0.9972 & 0.9986 \\ \hline \multirow{8}{*}{Recurrent Neural Network} & Benign & 0.9993 & 0.9998 & 0.9995 \\  & HTTP Flood & 0.9939 & 0.9949 & 0.9944 \\  & ICMP Flood & 0.9958 & 1.0000 & 0.9979 \\  & SYN Flood & 0.9958 & 0.9995 & 0.9976 \\  & SYN Scan & 0.9981 & 0.9944 & 0.9969 & 0.9959 \\  & Slowrate DoS & 0.9901 & 0.9890 & 0.9895 \\  & TCP Connect Scan & 0.9978 & 0.9951 & 0.9965 \\  & UDP Flood & 0.9998 & 0.9994 & 0.9996 \\  & UDP Scan & 0.9987 & 0.9928 & 0.9958 \\ \hline \multirow{8}{*}{KNN [65]} & Benign & 1.00000 & 0.99941 & 0.99971 \\  & HTTP Flood & 0.96652 & 0.97041 & 0.96846 \\  & ICMP Flood & 1.00000 & 1.00000 & 1.00000 \\  & SYN Flood & 0.99656 & 0.99246 & 0.99450 \\  & SYN Scan & 0.9923 & 0.99403 & 0.99667 & 0.99535 \\  & Slowrate DoS & 0.93403 & 0.93582 & 0.93492 \\  & TCP Connect Scan & 0.98946 & 0.99867 & 0.99404 \\  & UDP Flood & 1.00000 & 1.00000 & 1.00000 \\  & UDP Scan & 0.99958 & 0.99790 & 0.99874 \\ \hline \multirow{8}{*}{Random Forest [65]} & Benign & 1.00000 & 1.00000 & 1.00000 \\  & HTTP Flood & 0.98157 & 0.98845 & 0.98500 \\ \cline{1-1}  & ICMP Flood & 1.00000 & 1.00000 & 1.00000 \\ \cline{1-1}  & SYN Flood & 0.99658 & 0.99863 & 0.99760 \\ \cline{1-1}  & SYN Scan & 0.9963 & 0.99933 & 0.99601 & 0.99767 \\ \cline{1-1}  & Slowrate DoS & 0.97736 & 0.96435 & 0.97081 \\ \cline{1-1}  & TCP Connect Scan & 0.99801 & 0.99867 & 0.99834 \\ \cline{1-1}  & UDP Flood & 1.00000 & 1.00000 & 1.00000 \\ \cline{1-1}  & UDP Scan & 0.99707 & 0.99832 & 0.99770 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Testing performance evaluation per class—multi-class classification scenario. misclassification due to their subtle nature. Additionally, discrepancies can arise between SYNFIood and TCPConnectScan attacks, particularly in their request patterns. In SYNFIood attacks, the third request (ACK bit) is typically skipped, whereas it is sent in TCPConnectScan. Consequently, the first two requests in both attack types may exhibit similar characteristics, leading to misclassification.