## 4 Experiments and Their Outcomes
### Answer to Second RQ  
We assess the proposed CNN + BiLSTM model's performance in predicting DDoS attacks using benchmark data by comparing it to conventional machine learning models. The suggested word embedding-driven DL model outperforms traditional machine learning methods. Table 8 shows the results of the ML models as well as the suggested model. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Model Name** & \multicolumn{2}{c}{**Accuracy (\%)**} & \multicolumn{2}{c}{**Precision (\%)**} & \multicolumn{2}{c}{**Recall (\%)**} & \multicolumn{2}{c}{**F1-Score (\%)**} \\ \hline  & **FS(No)** & **FS(Yes)** & **FS(No)** & **FS(Yes)** & **FS(No)** & **FS(Yes)** & **FS(No)** & **FS(Yes)** \\ \hline CNN+ & & & & & & & & \\ BiLSTM-1 & 73 & 85.11 & 75 & 85 & 74 & 85 & 74 & 85 \\ \hline CNN+ & & & & & & & & \\ BiLSTM-2 & 76 & 86.01 & 78 & 86 & 76 & 86 & 74 & 86 \\ \hline CNN+ & & & & & & & & \\ BiLSTM-3 & 69 & 86.52 & 71 & 86 & 70 & 86 & 68 & 86 \\ \hline CNN+ & & & & & & & & \\ BiLSTM-4 & 64 & 87.56 & 69 & 87 & 64 & 87 & 62 & 87 \\ \hline CNN+ & & & & & & & & \\ BiLSTM-5 & 73 & 87.77 & 76 & 87 & 72 & 87 & 73 & 87 \\ \hline CNN+ & & & & & & & & \\ BiLSTM-6 & 72 & 91.46 & 77 & 91 & 73 & 89 & 74 & 90 \\ \hline CNN+ & & & & & & & & \\ BiLSTM-7 & 63 & 92.00 & 69 & 91.71 & 66 & 91 & 66 & 90.71 \\ \hline CNN+ & & & & & & & & \\ BiLSTM-8 & 77 & 92.05 & 81 & 92.47 & 77 & 91.31 & 77 & 91.16 \\ \hline CNN+ & & & & & & & \\ BiLSTM-9 & 71 & 93.10 & 74 & 93.41 & 71 & 91.92 & 72 & 92.62 \\ \hline CNN+ & & & & & & & \\ BiLSTM-10 & 79 & 94.52 & 80 & 94.74 & 79 & 92.04 & 79 & 93.44 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Evaluation of the performance of CNN-BiLSTM models with and without feature selection [FS(no) = without selection of features, FS(yes) indicates with selection of features]. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Study/Technique** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F-Score (\%)** \\ \hline  & Sambangi and Gondi, [1] & 78 & 79 & 78 & 78 \\  & (Multiple Linear Regression) & & & & \\ \cline{2-5}  & XGB & 76 & 76 & 76 & 76 \\ \cline{2-5} machine learning & SVM & 74 & 74 & 74 & 74 \\ \cline{2-5}  & Random Forest & 75 & 75 & 75 & 75 \\ \cline{2-5}  & LR & 64 & 64 & 64 & 64 \\ \cline{2-5}  & KNN & 71 & 71 & 71 & 71 \\ \hline Proposed Deep learning & CNN + BiLSTM & 83 & 84 & 83 & 83 \\ model (without FS) & & & & & & \\ Proposed Deep learning & & & & & & \\ model (with FS) & CNN + BiLSTM & 94.52 & 94.74 & 92.04 & 93.44 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Comparison of the proposed model to ML models. Accuracy, precision, recall, and the f-measure are all used to assess performance. Multiple linear regression has the best incremental learning accuracy, which is roughly 78 percent on both localhost and distant virtual hosts. However, K-neighbors had the best accuracy of 71%. Each experiment's details can be found in Table 8. The SVM algorithm produced an efficient accuracy of 74% for cloud testing. * CNN + BiLSTM vs. Multiple Linear Regression: The purpose of this experiment was to evaluate the efficacy of the proposed CNN + BiLSTM model with research by [1], which utilized a Multiple Linear Regression classifier to predict DDoS attacks using historical traffic data. In terms of precision (78), recall (79), F1-score (78), and accuracy (78), Multiple Linear Regression classifiers provided inferior results (Table 8). The Multiple Linear Regression model's poor performance might be attributable to a variety of factors as identified by [1]. * CNN + BiLSTM vs. XGBoost: The objectives of this investigation was to evaluate the suggested CNN + BiLSTM model against an extreme gradient boosting (XGBoost) classifier. As shown in Table 8, XGBoost classifiers yielded lower precision (76), recall (76), F1-score (76), and accuracy (76 percent). XGBoost receives a poor score because it is susceptible to overfitting in the presence of noisy data, needs a longer training period, and is difficult to tweak [38].