## 5 Discussion  
### Comparison with Machine Learning and Deep Learning Models  
To validate the effectiveness of the intrusion detection system, we compared the deep learning model CNN-BiLSTM with the machine learning models KNN, SVM, DT, MLP, LR, and RF. The results of the NSL-KDD and UNSW-NB15 datasets in terms of binary classification are shown in Figure 4. The CNN-BiLSTM model demonstrates notable accuracy, precision, recall, and F1-score, achieving scores of 99.78%, 99.58%, 99.72%, and 99.73% for the NSL-KDD dataset and 98.96%, 97.68%, 96.34%, and 97.37% for the UNSW-NB15 dataset, respectively. Figure 5 shows the results for both datasets in multiclass classification. Here, both the deep learning and machine learning models are trained to detect a specific attack, which is the DoS attack. By combining the performance of different classifications on the two datasets, we can achieve good results in terms of DoS attack detection, accompanied by a low FAR rate. As shown in Tables 5 and 6, the deep learning model achieves the highest accuracy compared with the machine learning models, with an accuracy of 99.89% on the NSL-KDD dataset and 98.95% on the UNSW-NB15 dataset. The results in Tables 5 and 6 are based on the average performance over five experimental runs for each model. Lower values of the standard deviation imply more stable results across several runs, and they show how consistently the model performs. Moreover, it can be seen that the deep learning model performs well in terms of the FAR on both datasets, indicating very accurate predictions. Amongst the machine learning models, it can be observed that the SVM model outperforms the machine learning models, with an accuracy of 98.65% on the NSL-KDD dataset. It effectively distinguishes between normal network and attack instances, resulting in a low FAR. SVM's ability to handle complex decision boundaries makes it suitable for intricate intrusion detection scenarios. On the other hand, KNN achieved the lowest accuracy in comparison with other machine learning models on the NSL-KDD dataset. It achieved an accuracy of 97.42% and a balanced precision-recall trade-off, indicating its effectiveness in correctly classifying both normal and attack instances. However, it has a relatively false alarm rate compared to the other models, and this is because it relies on a simple majority voting scheme among its nearest neighbors. Hence, in scenarios where the nearest neighbors include noisy or misclassified instances, KNN may produce false alarms when classifying test instances, especially in regions of the feature space where the density of training instances is sparse or heterogeneous. KNN outperforms the other machine learning models, with an accuracy of 97.78% on the UNSW-NB15 dataset. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Classifiers** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1-Score (\%)** & **FARnorm (\%)** & **FARattacks (\%)** \\ \hline KNN & 97.78 \(\pm\) 0.012 & 98.17 \(\pm\) 0.027 & 96.61 \(\pm\) 0.014 & 98.89 \(\pm\) 0.027 & 0.0466 & 0.0439 \\ \hline SVM & 97.42 \(\pm\) 0.004 & 96.88 \(\pm\) 0.026 & 97.38 \(\pm\) 0.004 & 96.62 \(\pm\) 0.026 & 0.0042 & 0.0264 \\ \hline DT & 95.32 \(\pm\) 0.044 & 94.60 \(\pm\) 0.011 & 93.66 \(\pm\) 0.044 & 95.69 \(\pm\) 0.011 & 0.0241 & 0.0111 \\ \hline MLP & 96.98 \(\pm\) 0.018 & 95.46 \(\pm\) 0.016 & 94.41 \(\pm\) 0.018 & 96.19 \(\pm\) 0.016 & 0.0177 & 0.0159 \\ \hline LR & 97.32 \(\pm\) 0.005 & 96.84 \(\pm\) 0.027 & 97.34 \(\pm\) 0.006 & 97.58 \(\pm\) 0.027 & 0.0056 & 0.0265 \\ \hline RF & 96.25 \(\pm\) 0.021 & 95.36 \(\pm\) 0.011 & 94.86 \(\pm\) 0.021 & 94.11 \(\pm\) 0.011 & 0.0205 & 0.0114 \\ \hline CNN-BiLSTM & 98.95 \(\pm\) 0.017 & 97.73 \(\pm\) 0.018 & 96.20 \(\pm\) 0.017 & 96.16 \(\pm\) 0.018 & 0.0172 & 0.0183 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Effective comparison of machine learning and deep learning on UNSW-NB15 datasets.