# Deep Feature Fusion via Transfer Learning for Multi-Class Network Intrusion Detection
## 5 Results
### Analysis of Results for the Proposed Method  
Accuracy and F1-score are used to evaluate the performance of the proposed model. Accuracy is defined as shown in Equation (9). \[Accuracy=\frac{TP+TN}{TP+TN+FP+FN}, \tag{9}\]  
where True Positive (TP) refers to the number of actual positive samples correctly classified as positive. At the same time, True Negative (TN) represents the number of actual negative samples correctly classified as negative. Conversely, False Positive (FP) indicates the number of actual negative samples incorrectly classified as positive, and False Negative (FN) denotes the number of actual positive samples incorrectly classified as negative. While this accuracy metric is useful for intuitively evaluating the model's overall performance, its reliability may decrease if there is a class imbalance problem. Therefore, this study uses the F1-score as a supplementary performance metric. F1-score, defined in Equation (12), is the harmonic mean of Precision and Recall. \[Precision=\frac{TP}{TP+FP}. \tag{10}\]  
\[Recall=\frac{TP}{TP+FN}. \tag{11}\]  
\[F1-score=\frac{2\times Precision\times Recall}{Precision+Recall} \tag{12}\]  
Here, Precision in Equation (10) represents the proportion of actual positive samples among those predicted as positive by the model, while Recall in Equation (11) denotes the proportion of correctly predicted positive samples among all actual positive samples. The F1-score, derived from these values, serves as an effective metric for assessing the model's overall performance, even in class imbalance scenarios. Figure 6 visually represents the loss and accuracy trends over epochs during the training process of the proposed model. This study applied the Early Stopping technique to prevent unnecessary training while maintaining optimal performance. As a result, training continued up to the 16 th epoch and was terminated early as no further performance improvement was observed. Figure 6a illustrates the changes in training and test loss over epochs, showing a gradual decrease and convergence of loss values as the model training progresses, indicating the model's gradual optimization process. Figure 6b presents the changes in training accuracy and test accuracy over epochs. As training progressed, \begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Class**} & **CIC-IDS 2017** & **CIC-IDS 2018** \\  & **(Source Domain)** & **(Target Domain)** \\ \hline Benign & 21,996 & 1003 \\ PortScan & 21,996 & - \\ DoS & 21,996 & 1001 \\ DDoS & 21,996 & 1001 \\ FTP-Patator & 5499 & 1003 \\ SSH-Patator & 5499 & 1003 \\ Bot & - & 1003 \\ Total & 98,982 & 6014 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Class distribution in source (CIC-IDS2017) and target (CIC-IDS2018) domains. accuracy steadily increased and eventually stabilized at a certain level. This observation confirms that the model is effectively learning from the training data while maintaining stable performance without signs of overfitting. For performance comparison of the proposed model, existing machine learning models such as k-nearest neighbor (KNN) [38], logistic regression (LR) [39], and support vector machine (SVM) [40] were used, as shown in Table 4. KNN is an algorithm that makes predictions and classifications based on the k closest neighbors of a data point. LR linearly combines input data, applies a Sigmoid function to convert it into probability values, and classifies labels accordingly. SVM is a model that classifies data by finding the optimal hyperplane to maximize the margin. Before evaluating the performance of models with transfer learning and feature fusion applied, the performance of existing models like CNN without these techniques was first compared, followed by the application of Attention and transfer learning. Here, NoTL refers to a state without transfer learning applied.