## 5 Experimental Results
### Baseline Experiment Comparison  
The C4.5 decision tree achieves an area under the ROC curve of 0.891, as shown in Figure 8, combined with an accuracy of 90.13%, a precision of 89.48%, and a recall of 84.16%. Its FPR of 12.03% and FNR of 15.84%, as shown in Table 5, reflect a model that excels at interpreting discrete protocols and categorical features yet suffers from overfitting to training traffic patterns. The resulting decision boundaries adapt closely to observed malicious signatures but exhibit limited robustness when presented with novel or slightly perturbed inputs. Aggregating two hundred trees in the CIC-RF framework yields superior stability and discrimination capacity, as shown in Table 5. The ensemble records an AUC of 0.934, as shown in Figure 8, and an accuracy of 93.48%. Precision reaches 91.42%, while recall stands at 88.47%, yielding a low FPR of 10.26% and an FNR of 11.53%. Bootstrap sampling decorrelates individual trees and reduces variance at the expense of interpretability. The model's dependence on high-dimensional continuous features necessitates dimensionality reduction or discretization during preprocessing which may obscure subtle temporal or sequential traffic characteristics. The FCM-SVM secures an AUC of 0.918, as shown in Figure 8, and an accuracy of 92.83%. Its precision equals 91.77%, while its recall reaches 86.82%, leading to an FPR of 11.08% and an FNR of 13.18%. FCM performs initial data clustering, while the Gaussian kernel SVM captures nonlinear separability in feature space; however, hyperparameter sensitivity limits real-time deployment and requires extensive cross-validation to achieve optimal performance. Despite these limitations, the hybrid FCM-SVM approach exhibits higher accuracy and generalization ability than the standalone methods. The Enhanced-MLP, composed of two hidden layers with rectified linear activations and Dropout regularization, records an AUC of 0.92, as shown in Figure 8, alongside an accuracy of 93.71%. It achieves a precision of 91.19% and a recall of 87.74%, resulting in an FPR of 10.52% and an FNR of 12.26%, as shown in Table 5. The MLP in the benchmark experiment is combined with clustering using the ReLU activation function to alleviate the gradient vanishing problem and combined with the Dropout layer to enhance the generalization ability by randomly deactivating neurons during training. Although the layered abstraction is able to learn to encrypt the complex associations of malicious traffic, the static fully connected topology still has limitations in modeling dynamic time dependencies when attack and benign traffic exhibit highly overlapping feature distributions, although reducing dropout can alleviate the overfitting problem. The EFTransformer model demonstrates exceptional performance in attack detection, achieving an AUC of 0.947, as shown in Figure 8. The model sustains a recall of 94.15% while maintaining an impressively low FPR of 6.19%. This balance yields a precision of 91.30%, an F1 score of 95.12%, and an overall accuracy of 95.26%, as shown in Table 5. These figures confirm that EFTransformer not only identifies the vast majority of malicious sessions but does so with minimal collateral alerts, making it highly suitable for deployment under strict operational thresholds. The model's stable output in multiple rounds of \begin{table}
\begin{tabular}{l c c c c c c} \hline \hline
**Model** & **Accuracy** & **Precision** & **Recall** & **F1 Score** & **FPR** & **FNR** \\ \hline C4.5 Decision Tree & 90.13\% & 89.48\% & 84.16\% & 87.21\% & 12.03\% & 15.84\% \\ CIC-RF & 93.48\% & 91.42\% & 88.47\% & 91.65\% & 10.26\% & 11.60\% \\ FCM-SVM & 92.83\% & 91.77\% & 86.82\% & 10.58\% & 11.08\% & 13.18\% \\ Enhanced-MLP & 93.71\% & 91.19\% & 87.74\% & 91.78\% & 10.52\% & 12.26\% \\ EFTransformer (Ours) & 95.26\% & 92.30\% & 94.15\% & 95.12\% & 6.19\% & 5.85\% \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Baseline model performance comparison. experiments and ablation tests shows that it is highly robust under noisy conditions.