# A Complete EDA and DL Pipeline for Softwarized 5G Network Intrusion Detection
## 5 Experimental Results and Discussion
### DL-Based Framework's Results and Discussion
#### 5.4.2 Multi-Class Classification Scenario  
The performance of the proposed framework was also evaluated for a multi-class classification scenario, in order to further investigate the framework's capabilities. Table 2 provides an overview of the performance of the framework, while Table 3 provides a more detailed view of the performance per attack type. Similar observations to the binary scenario are made here, in terms of the effective detection capability of the different DL models, with all of them having an accuracy, precision, recall, and F1-score above 99%, as they outperformed the KNN and random forest models proposed in [65]. This highlights the importance and capabilities of the proposed DL-based models. More specifically, the proposed DL-based models in this work outperformed the classical models from previous literature works (e.g., in [65]) by up to 1% in terms of detection accuracy. Similarly, a comparable training time was required when training the dense autoencoder neural network and the convolutional neural network models, while that of the recurrent neural network model was significantly higher. Compared to models from previous works, the training time was actually considered to be improved, with models such as KNN requiring almost double the training time of the dense autoencoder neural network model. This again reiterates the value of adopting such models. On top of these observations, it was further observed that the testing/prediction time was longer (in the region of 3-4 min) compared to the binary classification scenario. This was attributed to the fact that, in this case, the goal was not to merely detect the attack, but also its type. Hence, this investigation often involved further analysis to determine the attack type. However, this testing/prediction time is still considered acceptable in a real-world scenario, as it would allow network providers to quickly take countermeasures to stop or mitigate the attacks. More specifically, attacks such as UDP Flood and SYN Flood can last anywhere between one to several days (around 72 h in the case of UDP Flood attacks) [72]. Therefore, detecting such attacks within minutes would allow network providers to deploy different mechanisms to stop or mitigate any negative impacts that such attacks might have. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Model** & **Accuracy** & **Precision** & **Recall** & **F1-Score** & \
\begin{tabular}{c} **Training** \\ **Time (s)** \\ \end{tabular} &
\begin{tabular}{c} **Prediction** \\ **Time (s)** \\ \end{tabular} \\ \hline Dense Autoencoder Neural Network & 1.0 & 1.0 & 1.0 & 1.0 & 904 & 41 \\ \hline Convolutional Neural Network & 0.9994 & 0.9996 & 0.9993 & 0.9995 & 864 & 83 \\ \hline Recurrent Neural Network & 0.9981 & 0.9981 & 0.9981 & 0.9981 & 1005 & 12 \\ \hline KNN [65] & 0.9997 & 0.9997 & 0.9997 & 0.9997 & 61 & 8 \\ \hline Random Forest [65] & 0.9998 & 0.9998 & 0.9998 & 0.9998 & 59 & 8 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Testing performance evaluation—binary classification scenario. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Model** & **Accuracy** & **Precision** & **Recall** & **F1-Score** & \
\begin{tabular}{c} **Training** \\ **Time (s)** \\ \end{tabular} &
\begin{tabular}{c} **Prediction** \\ **Time (s)** \\ \end{tabular} \\ \hline Dense Autoencoder Neural Network & 0.9975 & 0.9971 & 0.9970 & 0.9970 & 1177 & 42 \\ \hline Convolutional Neural Network & 0.9984 & 0.9984 & 0.9983 & 0.9984 & 1043 & 203 \\ \hline Recurrent Neural Network & 0.9981 & 0.9981 & 0.9981 & 0.9981 & 1334 & 182 \\ \hline KNN [65] & 0.9923 & 0.9923 & 0.9923 & 0.9923 & 2066 & 360 \\ \hline Random Forest [65] & 0.9963 & 0.9963 & 0.9963 & 0.9963 & 521 & 5 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Testing performance evaluation—multi-class classification scenario.