# Deep Learning-Based Network Intrusion Detection Using Multiple Image Transformers
## 4 Performance Evaluation
### Detection Rate  
To accurately compare the detection rate for each algorithm, the results of all image transformers and the existing '1 channel' algorithm and 'Non-image' algorithm were measured. Figure 5 shows the measurement results of the detection rates for each algorithm for the ISCXIDS2012 dataset. Since the 'Non-Image' algorithm has higher precision than the '1 channel' algorithm, the probability of classifying a normal session as an intrusion is low. The '1 channel' algorithm has a higher recall value than the 'Non-image' algorithm and is superior in detecting actual intrusions. The proposed algorithm achieves the highest performance for all metrics such as accuracy, precision, recall, and F1-score compared to all image transformers including the 'Non-image' algorithm and the '1 channel' algorithm. Figure 5 shows that the performance of image transformers varies considerably, and that the overall performance is mostly inferior to that of the '1 channel' and 'Non-image' algorithms. However, the proposed algorithm achieved the highest performance when using these  
\begin{table}
\begin{tabular}{c c c c} \hline
**Label** & **Training Dataset** & **Validation Dataset** & **Testing Dataset** \\ \hline BruteForce-SH & 3000 & 1000 & 1000 \\ \hline DDoS & 36,000 & 12,000 & 12,000 \\ \hline HTTPoS & 1500 & 500 & 500 \\ \hline Infiltration & 2700 & 900 & 900 \\ \hline Normal & 60,000 & 20,000 & 20,000 \\ \hline Total & 103,200 & 34,400 & 34,400 \\ \hline \end{tabular}
\end{table}
Table 1: Each class size in ISCXIDS2012 dataset.  
\begin{table}
\begin{tabular}{c c c c} \hline
**Label** & **Training Dataset** & **Validation Dataset** & **Testing Dataset** \\ \hline Benign & 30,000 & 10,000 & 10,000 \\ \hline Bot & 6000 & 2000 & 2000 \\ \hline BruteForce-FTP & 5400 & 1800 & 1800 \\ \hline BruteForce-SH & 5400 & 1800 & 1800 \\ \hline BruteForce-WEB & 360 & 120 & 120 \\ \hline DDoS-HOIC & 7200 & 2400 & 2400 \\ \hline DDoS-LOIC-HTTP & 7200 & 2400 & 2400 \\ \hline DoS-GoldenEye & 2400 & 800 & 800 \\ \hline DoS-Hulk & 7200 & 2400 & 2400 \\ \hline DoS-SlowHTTPTest & 5400 & 1800 & 1800 \\ \hline DoS-Slowloris & 1500 & 500 & 500 \\ \hline Total & 78,060 & 26,020 & 26,020 \\ \hline \end{tabular}
\end{table}
Table 2: Each class size in CSE-CIC-IDS2018.  
image transformers. The proposed algorithm significantly improves the detection accuracy by integrating the results of the three best image transformers.  
It can be confirmed that the RGB color image used by the proposed method is significantly more effective than the grayscale image through the results using the three-channel image and the one-channel image. In addition, when generating a color image, the selection algorithm that determines an image for each channel plays a major role in generating a good quality image.  
Figure 6 shows the detection performance for the CSE-CIC-IDS2018 dataset and a trend similar to that of the ISCXIDS2012 dataset. However, noting that the 'Non-image' algorithm has a higher F1-score than the '1 channel' algorithm, it cannot be guaranteed that the image transformer improves intrusion detection performance compared to the existing method using session features. However, the proposed algorithm still showed the best performance compared to the '1 channel' and 'Non-image' algorithms. Therefore, it is concluded that the proposed algorithm exhibits the highest performance compared with competing algorithms in various environments.  
Figure 5: Detection rate for each algorithm on the ISCXIDS2012 dataset.  
Figure 6: Detection rate for each algorithm on the CSE-CIC-IDS2018 dataset.