# Image-Based Malicious Network Traffic Detection Framework: Data-Centric Approach
## 4 Experimental Results
### The Results of CNN Model Training  
To evaluate the classification performance of our proposed model, the generated image dataset of 148,517 images was divided into three sets: a training set (60%), a validation set (20%), and a test set (20%). The model was trained using the training set, and the validation set was utilized for verifying classification accuracy performance and tuning hyperparameters. Finally, the test set was employed to evaluate the model's generalization performance. When a model is trained, the choice of weight initialization method is an important factor, as it determines the outcome of the model training. TensorFlow offers various weight initialization methods, including Glorot initialization [89] and He initialization [90]. In this study, we used the Glorot initialization method, which initializes weights randomly, and as a result, the model training results can vary each time. Therefore, we measured the model training results a total of 10 times and calculated the average value as the final classification performance of the model. Figure 7 shows the results of 10 model training runs. Each training run was performed for a total of 100 epochs with a batch size of 32 and a learning rate of 0.0001. The average accuracy was 99.46%, and the val_accuracy was 99.09%, indicating excellent classification performance. During the 100 epochs, the average loss and val_loss converged to 0.0139 and 0.041, respectively, but the val_loss tended to diverge again after the 60 th epoch. To evaluate the classification accuracy performance of the model, we used a confusion matrix. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Images** & **Accuracy** & **Validation** & **Loss** & **Validation** \\  & **(\%)** & **Accuracy (\%)** & **Loss** & **Loss** \\ \hline With feature correlation & 99.59 & 99.09 & 0.0115 & 0.0309 \\ Without feature correlation & 99.44 & 98.98 & 0.0143 & 0.0333 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Comparison of model training results for images with correlation considered and images without correlation. Figure 6: Comparative analysis of model performance trained on images with and without feature correlation. (**a**) Training and validation accuracy graph for models trained on images with and without feature correlation; (**b**) training and validation loss graph for models trained on images with and without feature correlation. \[\text{Accuracy}=\frac{TP+TN}{TP+TN+FP+FN} \tag{9}\]  
\[\text{Precision}=\frac{TP}{TP+FP} \tag{10}\]  
\[\text{Recall}=\frac{TP}{TP+FN} \tag{11}\]  
\[\text{F-score}=\frac{2\times\text{Precision}\times\text{Recall}}{\text{ Precision}+\text{Recall}} \tag{12}\]  
\[\text{False Positive Rate}=\frac{FP}{FP+TN} \tag{13}\]  
\[\text{False Negative Rate}=\frac{FN}{FN+TP} \tag{14}\]  
Detailing the terms within this matrix, True Positive (TP) refers to the accurate classification of attack samples as attack, and True Negative (TN) denotes the correct classification of normal samples as normal. On the other hand, False Positive (FP) signifies the misclassification of normal samples as attack, and False Negative (FN) indicates the misclassification of attack samples as normal. These four metrics constitute the confusion matrix, with performance being measured using Equations (9)-(14). Figure 8 and Table 9 display the confusion matrix and evaluation metric results, respectively. Figure 7: The results of model training accuracy and loss. (**a**) Training accuracy; (**b**) validation accuracy; (**c**) training loss; (**d**) validation loss. The model's generalization performance was evaluated using the test set. Based on the confusion matrix shown in Figure 9 (TP = 14,115, FN = 178, FP = 100, and TN = 15,311), the precision, recall, F1-score, and accuracy were 0.9930, 0.9875, 0.9902, and 99.06%, respectively. Furthermore, the proposed model achieved a false positive rate (FPR) of 0.65% and a false negative rate (FNR) of 1.25%.