## 3 Methodology
### Model Evaluation  
The performance of the proposed intrusion detection system was evaluated using a combination of widely accepted classification metrics: accuracy, precision, recall, F1-score, and the confusion matrix [22; 23; 24; 25; 26]. These metrics provide a comprehensive understanding of the model's ability to correctly identify anomalous and normal network traffic [27; 28; 29; 30]. Let the confusion matrix be defined as follows:  
* TP (True Positives): Correctly predicted anomalies;
* TN (True Negatives): Correctly predicted normal instances;
* FP (False Positives): Normal instances incorrectly classified as anomalies;
* FN (False Negatives): Anomalies incorrectly classified as normal. The evaluation metrics are defined as follows:
* Accuracy  
This measures the proportion of total correct predictions:  
\[\text{Accuracy}=\frac{TP+TN}{TP+TN+FP+FN}\]
* Precision  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Stage** & **Component** & **Layer** & **Output** & **Connected to** \\ \hline Input & Input Layer & \begin{tabular}{c} Preprocessed and selected \\ features (e.g., 20) \\ \end{tabular} & Feature vector & ANN Input, SVM Input \\ \hline \hline \multirow{8}{*}{ANN block} & Dense Layer 1 & 64 neurons, ReLU activation & Activation map & Dense Layer 2 \\ \cline{2-5}  & Dropout Layer & Dropout rate: 0.3 & \begin{tabular}{c} Regularized \\ activation \\ \end{tabular} & Dense Layer 2 \\ \cline{2-5}  & Dense Layer 2 & \begin{tabular}{c} 32 neurons, ReLU \\ activation \\ \end{tabular} & Activation map & Dense Layer 3 \\ \cline{2-5}  & Dropout Layer & Dropout rate: 0.2 & \begin{tabular}{c} Regularized \\ activation \\ \end{tabular} & Dense Layer 3 \\ \cline{2-5}  & Dense Layer 3 & \begin{tabular}{c} 16 neurons, ReLU \\ activation \\ \end{tabular} & Activation map & Output Layer \\ \cline{2-5}  & Output Layer & \begin{tabular}{c} 1 neuron, Sigmoid \\ activation \\ \end{tabular} & \begin{tabular}{c} ANN prediction \\ (probability) \\ \end{tabular} & RF Input \\ \hline SVM block & SVM & RBF kernel (or linear), C = 1.0 & \
\begin{tabular}{c} SVM prediction \\ (probability) \\ \end{tabular} & RF Input \\ \hline Fusion & Meta Layer (Random Forest) & Input: ANN prob + SVM prob (2 features) & Final prediction (binary output) & Decision Interface \\ \hline Explainability & SHAP/visualization layer & Feature importance for RF input &
\begin{tabular}{c} Explanation \\ plots/rankings \\ \end{tabular} & User/Analyst Interface \\ \hline \hline \end{tabular}
\end{table}
Table 3: Layered ensemble architecture.  
This represents the proportion of correctly predicted anomalies out of all instances predicted as anomalies:  
\[\text{Precision}=\frac{TP}{TP+FP}\]  
* Recall (also known as Sensitivity or True Positive Rate) This measures the model's ability to correctly detect actual anomalies: \[\text{Recall}=\frac{TP}{TP+FN}\]
* F1-Score The harmonic mean of precision and recall offers a balance between the two: \[\text{F1-Score}=2\ \times\ \frac{Precision\times Recall}{Precision+Recall}\]  
These metrics were computed from the confusion matrices generated during model evaluation on the test dataset. Together, they provide insights not only into overall correctness but also into the model's reliability in identifying intrusions without over-flagging normal behavior.