# Deep Learning for Intrusion Detection Systems (IDSs) in Time Series Data +
## 5 Experiments
### Impact of W in Model Performance  
Firstly, we want to test the effect of the window size on the model's accuracy. For this reason, we predict the label of the \(W+1\) packet using a window size (\(W\)) of ascending size. For this experiment, we use network-based grouping. We also want to test these cases against the classic, real-time binary classification to compare the efficiency of the two different approaches. For this experiment, the value of \(T\) is fixed, with \(T=1\). With this value fixed, after the time series formatting, we end up with 2,540,033 time series objects with 2,540,043 initial instances. This is expected since we have overlapping time steps and  
Figure 5: ROC curves for flow-based vs. network-based grouping.  
we also have \(-10\) instances for the first time series object. The label distribution is the same as the original dataset. The results can be viewed in Table 4.  
A simple (real-time) classification scenario yields marginally better results compared to the time series case, which is unsurprising, given that making classifications using present variables is substantially easier than making predictions about future events. Specifically, the F1 score of the classification method is only \(1\%\) higher than that of the time series model for \(W=50\), which is deemed acceptable. Additionally, the study indicates that an increase in the input window size enhances model accuracy. This is because utilizing more samples generally leads to improved predictions, by providing more data for analysis. Nevertheless, this also entails a greater computational burden, as a larger window entails more parameters for the model. More specifically, the study demonstrates that the metrics when \(W\) is increased from \(W=1\) to \(W=50\), with a 5-6% increase for each case. No further significant enhancement in the metrics is observed between \(W=50\) and \(W=200\), implying that all relevant information for the prediction has already been exploited considering that the lifetime of any interaction between an actor and the IDS is briefer). Consequently, the methodology described herein involves a natural compromise between computational complexity and accuracy, necessitating customization for each unique application.  
We also present ROC curves for the IDS classification and the time series approach with \(W=50\) in Figure 6.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Model** & **F1 Score** & **Precision** & **Recall** \\ \hline Classification & 0.85 & 0.90 & 0.78 \\ Time Series (\(W=1\)) & 0.72 & 0.80 & 0.68 \\ Time Series (\(W=25\)) & 0.77 & 0.80 & 0.77 \\ Time Series (\(W=50\)) & 0.83 & 0.86 & 0.80 \\ Time Series (\(W=100\)) & 0.83 & 0.86 & 0.81 \\ Time Series (\(W=200\)) & 0.83 & 0.86 & 0.82 \\ \hline \hline \end{tabular}
\end{table}
Table 4: The results of the ascending input window size.  
Figure 6: ROC curves for classification vs. IDS time series.  
In general, we observe slightly improved outcomes for the classification scenario, as anticipated as our approach lacks information about the packet whose label is predicted. Nevertheless, upon examining both the ROC curve and the AUC score, we note that the disparity is minimal. Subsequently, our method remains viable, supporting proactive security measures.