## 4 Experimental Results and Analysis
### NSL-KDD Results and Analysis  
We conducted a comprehensive evaluation and comparison of CBF-IDS with other algorithms on the NSL-KDD dataset. The experimental results indicate that CBF-IDS achieved an F1 score of 99.40%. For a detailed overview of the multi-classification performance of CBF-IDS and other algorithms on the NSL-KDD dataset, Table 8 is presented, highlighting the best metrics in bold. From Table 8, it can be observed that CBF-IDS achieves slightly lower accuracy compared to the work presented in [32]. This difference arises because of [32] addressed class imbalance in the NSL-KDD dataset by combining ADASYN with the Tomek links techniques. Although ADASYN-Tomek links represents an effective method for handling class imbalance, it does come with certain challenges. This method may be affected by the curse of dimensionality, particularly when dealing with large-scale and high-dimensional data. Additionally, both ADASYN and Tomek links sampling techniques require the analysis and computation of each sample to determine which samples need synthetic generation. This can potentially result in longer computation times and increased memory requirements. In contrast, CBF-IDS employs the focal loss function to address class imbalance without the need for additional data operations. It achieves this by adjusting the weighting factor and modulating factor in the loss function. In Table 8, CBC-IDS, CBA-IDS, and CBF-IDS represent models with the same CNN-BiLSTM structure but have different loss functionsintegrated within them. For multi-classification on NSL-KDD, CBF-IDS, using the focal loss function, outperforms other loss functions in terms of performance. Table 9 displays a performance comparison of various model structures for multi-classification on NSL-KDD, highlighting the best metrics in bold. We observed that as the number of convolutional layers increased, CNN models showed improved performance in multi-classification. Furthermore, for the CNN-BiLSTM hybrid model with the same number of convolutional layers, integrating BiLSTM improved multi-classification performance when compared to pure CNN models without BiLSTM integration. \begin{table}
\begin{tabular}{c c} \hline \hline
**Hyperparameter** & **Setting** \\ \hline Batch Size & 32 \\ Optimizer & Adam \\ Learning Rate & 0.001 \\ CNN Activation Function & Relu \\ BiLSTM Activation Function & Tanh \\ Dropout Rate & 0.5 \\ Loss Function & Focal Loss \\ \(\alpha\) & 0.25 \\ \(\gamma\) & 2 \\ Epoch & 50 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Hyperparameter setting. In order to assess the impact of focal loss on the model's performance in handling the minority class, we conducted an evaluation of the CNN-BiLSTM model's performance in each class. Table 10 presents the precision, recall, and F1 scores of the model for different classes using three loss functions: CE, \(\alpha\)-balanced CE, and focal loss. The best F1 scores are highlighted in bold. The results in Table 10 show that CBF-IDS, when using focal loss, achieves the highest F1 score for all network traffic types. As depicted in Figure 7, CBF-IDS attains a precision of 77.78%, a recall of 58.33%, and an F1 score of 66.67% for the minority class U2R. CBF-IDS outperforms other models in terms of detection performance metrics for the minority class U2R. When compared to CBC-IDS, CBF-IDS demonstrates improvements of 16.66%, 133.32%, and 83.36% in precision, recall, and F1 score, respectively. Similarly, when compared to CBA-IDS, CBF-IDS exhibits improvements of 16.66%, 39.98%, and 30.01% in precision, recall, and F1 score, respectively.