## 5 Discussion  
The evaluation results of CBF-IDS with different datasets confirm its excellent performance as an IDS. Our experimental results demonstrate that CBF-IDS excels in a range of key performance metrics, including accuracy, precision, recall, and F1 score, outperforming other models. These findings underscore its effectiveness in accurately identifying and classifying network intrusions, providing a promising solution for enhancing network security defenses. Our research investigation into focal loss is particularly intriguing. The experimental results of CBF-IDS, when using diverse datasets, provide validation for the efficacy of focal loss in improving model performance. Our research findings consistently demonstrate that CBF-IDS achieves the highest recall and F1 score for minority classes across three datasets when employing focal loss. When compared to models using traditional CE or \(\alpha\)-balanced CE, this significant performance improvement affirms the efficacy of focal loss in tackling the challenge of class imbalance. This finding holds particular significance in the field of intrusion detection, where accurately detecting rare and subtle attack patterns is crucial for effective threat mitigation. The three datasets used in this paper, NSL-KDD, UNSW-NB15, and CIC-IDS2017, are widely utilized in traditional intrusion detection research and have gained recognition for their validation and effectiveness in traditional network environments [24, 27, 32, 59]. However, some studies have attempted to employ these datasets for intrusion detection research in the context of the Internet of Things (IoT) to assess the performance of IDS for IoT. It is important to note that IoT environments differ from traditional network environments, and these differences may result in the IDSs that are trained on traditional network intrusion detection datasets being less effective at detecting actual intrusion behaviors in IoT environments [60]. In order to more accurately evaluate the performance of CBF-IDS in IoT environments and enhance its generalization capability across diverse network environments, we plan to utilize datasets specifically designed for the IoT environments in our future work to train the model. The longer runtime of CBF-IDS can be attributed to its hybrid model characteristic, which demands more computational resources and time to enhance the model's detection performance. It is noteworthy that recent research has successfully employed hybrid models to address network intrusion detection issues [61, 62, 63]. [PERSON] et al. [61] proposed an IDS that combines CNN and LSTM and validated its effectiveness in a big data environment. [PERSON] et al. [62] developed an IDS based on a CNN-LSTM architecture for securing industrial IoT (IIoT). Furthermore, [PERSON] et al. [63] introduced a hybrid convolutional recurrent neural network (CNN-RNN) NIDS, demonstrating its effectiveness in the field of network intrusion. These successful studies demonstrate that employing hybrid models is a viable and effective approach when dealing with intrusion detection challenges. CBF-IDS, as a CNN-BiLSTM-based hybrid model, excels in handling large-scale and high-dimensional datasets due to its relatively higher complexity. Especially in network environments with ample computational capabilities and hardware resources, such as IIoT [62], CBF-IDS can fully leverage its advantages. Network environments equipped with sufficient computational capabilities and hardware resources render the deployment of CBF-IDS feasible. In these scenarios, the complexity of CBF-IDS is no longer a limiting factor; instead, it becomes an advantage, enabling the effective handling of complex network intrusion behaviors. However, it is essential to recognize that not all network environments possess the computational capabilities and hardware resources suitable for deploying CBF-IDS. In some scenarios, it is the complexity of CBF-IDS that may pose limitations.