## 4 Results and Discussion
### Performance Evaluation
#### 4.2.2 Multi-Class Machine Learning Model  
In the same process as for the two classifications, dataset machine learning models were used for training and testing. In order to more accurately simulate network attacks in real life situations and to classify different attacks. This paper extends the two classifications into multiple classifications to identify different types of attacks. (1) KNN algorithm parameter setting: In order to save computational effort and processing time, the range and step size of \(K\) values were set to be the same as in the case of two classification. The experimental results show that the highest classification accuracy is achieved with \(K=3\). The value of \(K\) is set in line with the case of two classification, which reduces the complexity of the comparison and the difficulty of the calculation to some extent. (2) Decision Tree algorithm parameter setting: As in the case of two classification, the algorithm needs to determine the maximum depth and minimum number of samples required for the leaf nodes in the multi-level classification case. The range of values and step size of each parameter are set to the same as in the two classification case. The experimental results showed that the classification accuracy was stable at 99.84% when the maximum depth of the tree was greater than or equal to 27. To reduce the computational effort and the complexity of machine learning as much as possible, the maximum depth of the tree was set to 27. Subsequently, the number of leaves and he minimum number of samples of nodes was tested. The experimental results showed that when the depth of the Decision Tree is 27, the classification accuracy of the classifier decreases as the minimum number of samples of the leaf nodes increases. So the maximum number of samples of the leaf nodes was set to 2. For the KNN algorithm, \(K=3\) provides the best results. For the DT algorithms, result show that optimal results are achieved when the maximum depth of the tree is 27 and the maximum number of samples of the leaf nodes is 2. Figure 6 shows the confusion matrix for multi-class classification by KNN, Naive Bayes, BPNN and DT. Figure 7 shows the results for multiple classifications. After 10 experiments comparing the \(s_{F1}\) of the ADL neural network model and the traditional machine learning classification model, it was demonstrated that the classification performance of the ADL neural network model was better. Since the \(s_{F1}\) refers to the weighted average of precision and recall, it can be concluded experimentally that the \(s_{F1}\) of the ADL classifier reaches its highest value when \(\theta=0.8\). By applying the ADL algorithm with the traditional machine learning algorithm, the performance metrics of the classifier were significantly improved. In particular, the \(s_{A}\) of the NB algorithm improved from 94.84% to 98.77% and the \(s_{R}\) improved from 95.06% to 99.75%. The improvements in accuracy and recall were more pronounced than those model without the ADL algorithm to extract features. The performance metrics are summarised in Table 4.  
Figure 6: The confusion matrix results of multi-classification using the existing four classification methods: KNN, Naive Bayes, BPNN and DT. In traditional machine learning, the NB algorithm has the worst performance, whose performance is summarised in Table 5. Next, after adding the ADL algorithm to the NB algorithm, Table 6 shows the effect of using the ADL algorithm on the performance improvement of the NB algorithm. The reason for the negligible performance improvement for the DoS data is that the main attacks in the network come from DoS attacks, so the number of DoS attacks is large and better classification can be achieved without feature extraction. R2L and U2R are relatively small data in the dataset and the performance is greatly improved after feature extraction.