## 4 Results and Discussion
### Security Analysis Using an Adversarial Attack Model
#### 4.2.2 Attack Generation and Preprocessing of Generated Attack Data
Although the results are promising, we would need to collect a much larger dataset of real-world traffic and use techniques such as data augmentation to avoid overfitting. However, it should be noted that the proposed architecture remains to be deployed in a real-world setting. ## 5 Conclusions

The literature review examined various contemporary IDSs that utilize ML techniques across various environments. These techniques include information-based, similarity-based, probability-based, and error-based learning. The review also explored hybrid and SDN models in this context. This paper has undertaken a comprehensive literature research to improve NIDSs using ML techniques. Using a new architecture design, the proposed IDS is designed to scan all servers' incoming traffic and redirect it to the requested server by creating a centralized proxy server. A two-layer security-based mechanism is proposed. Before reaching the central server, a preliminary layer of security is implemented, including examining global traffic. The second layer of security is implemented when the network traffic is dispersed from the central server to the sub-networks of the organization. This paper presents and analyzes the results of the AdaBoost, Voting, Stacking, Support Vector Machine, Random Forest, and XGBoost models on the CIC-MalMem-2022, CIC-IDS-2018, and CIC-IDS-2017 datasets. The results show that XGBoost and Stacking are the best models. The first model used is XGBoost, which can perform the rapid identification of harmful instances. Subsequently, a Stacking classifier is utilized as the second model, demonstrating a notable level of accuracy but necessitating an extended detection duration. The activation of each model will be determined based on the volume of network traffic. The determination of the threshold value, which accurately represents the level of network traffic, is undertaken by the network administrator. The activation of the quickest model occurs when the amount of traffic is above the predetermined threshold value. Alternatively, \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Author** & **Feature Selection** & **Algorithm** & **Selected Features** & **Accuracy** & **Test Time** \\ \hline
[37] & Correlation Heatmap & Voting classifier & 10 & 96.25\% & 15.86 s \\ This study & SelectKBest & XGBoost & 30 & 99.84\% & 0.04 s \\ \hline \hline \end{tabular}
\end{table} 
Table 16: Comparative analysis of CIC-IDS-2017 Dataset. \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Author** & **Feature Selection** & **Algorithm** & **Selected Features** & **Accuracy** & **Test Time** \\ \hline
[24] & RF and PCA & LightGBM & 37 & 97.73\% & 17.94 s \\ This study & VarianceThreshold & XGBoost & 72 & 99.73\% & 0.03 s \\ \hline \hline \end{tabular}
\end{table} 
Table 15: Comparative analysis of CIC-IDS-2018 Dataset. the model with greater accuracy and longer detection times will be engaged. For the second layer, the Stacking model is used. They achieve a high level of accuracy in detecting harmful activities. The findings of this experiment indicate that the XGBoost model exhibits the highest speed in identifying malicious data across all three datasets (CIC-MalMem-2022, CIC-IDS-2018, and CIC-IDS-2017). Conversely, the Stacking approach demonstrates the highest accuracy in this context. However, identifying fraudulent material necessitates a more significant amount of time. Based on the findings of the XGBoost model, on the CIC-MalMem-2022, CIC-IDS-2018, and CIC-IDS-2017 datasets, it exhibits accuracy rates of 99.96%, 99.73%, and 99.84%, respectively, achieved within time intervals of 0.01 s, 0.03 s, and 0.04 s, respectively. The Stacking model achieved accuracy values of 99.98%, 99.61%, and 99.86% on the CIC-MalMem-2022, CIC-IDS-2018, and CIC-IDS-2017 datasets, respectively. The findings indicate that the multi-model IDS that relies on traffic load is significantly capable of efficiently identifying and detecting malicious activity.