## 5 Results and Discussion  
To evaluate the performance of NIDS in terms of accuracy (AC), different metrics were used; precision (P), recall (R), and F-measure (F). These metrics can be calculated using confusion matrix parameters: true positive (the number of anomalous instances that are correctly classified); false positive (the number of normal instances that are incorrectly classified as anomalous); true negative (the number of normal instances that are correctly classified); and false negative (the number of anomalous instances that are incorrectly classified as normal). A good NIDS must achieve high DR and FAR. Accuracy (AC): This is the percentage of correctly classified network activities. As shown in Table 5.  
Precision (P): The percentage of predicted anomalous instances that are actual anomalous instances; the higher P, the lower FAR. As shown in Table 5.  
Recall (R): the percentage of predicted attack instances versus all attack instances presented. As shown in Table 5.  
F-measure (F): measuring the performance of NIDS using the harmonic mean of the P and R. We aim to achieve a high F-score. As shown in Table 5.  
We compare XGBoost against the other two tree- based methods, RF and DT. Using the test set, which includes the four types of attacks as discussed in Figure 5. Three different evaluation metrics are computed; F-score, precision and recall. As shown in Figure 5, XGBoost ranked first in the evaluation, with an F1-score of 95.55%, while RF and DT achieved 94.6% and 94.5%, respectively. For precision, XGBoost outperformed RF and DT with a score of 92%, while RF and DT scored 90% and 90.2% respectively. Finally, for Recall, our proposed method with XGBoost proves its stability with a score of 98% while for RF and DT, the results were 82%, and 85%, respectively. From these results, the proposed model with XGBoost performs with high precision and high recall, which means that the classifier returns accurate results and high precision, while, at the same time, returning a majority of all positive results (it's an attack and the classifier detects that it's an attack), which means high recall. \begin{table}
\begin{tabular}{c c} \hline \hline
**Evaluation Metric Name** & **Equation** \\ \hline Accuracy (A) & (TP + FP)/(FP + TP + FN + TN) \\ Percision (P) & TP/(FP + TP) \\ Recall (R) & TP/(TP + FN) \\ F-score (F) & (2*P*R)/(P + R) \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Detailed equations for different performance evaluation metrics. In this evaluation, the accuracy metric is chosen in order to measure the performance of the proposed method against the results of [PERSON] [27] on the binary classification task. The binary classification task represents the model's ability to detect whether there is an attack or not in the network environment. The accuracy metric measures tolerance, or how close the predicted classification values are to the true values. As shown in Figure 6, the proposed XGBoost algorithm with the selected five features achieved a high accuracy score of 95.55%, compared with the deep neural network with six features proposed by [PERSON] [27], which had a score of 75.75%. In addition, from the previous Figure 5, we showed that the proposed model performs with high precision, with a score of 92%. Higher precision is related to reproducibility and repeatability; it is the degree to which repeated measurements on the classification task, under unchanged conditions, show the same results. We conclude from the previous scores that the proposed algorithm is accurate and stable in the binary classification task. Figure 5: The proposed model XGBoost is compared with other tree-based machine learning algorithms, using F1-score, precision and recall as evaluation metrics. Figure 6: Accuracy score is measured in order to evaluate the performance of the proposed XGBoost model against the Deep Neural Networks model.