\begin{table}[!htb]
  \centering
  % ensure any earlier floats are out
  \captionsetup{hypcap=false}% temporarily disable hypcap
  \caption{Evaluation metrics (all phases)}
  \label{tab:cosine_vs_knn}
  \captionsetup{hypcap=true} % restore for subsequent floats

  \begin{tabular}{l c c c p{5cm}}
    \toprule
    \textbf{Phase}     & \textbf{Adjacency Type} & \textbf{Accuracy} & \textbf{F1-Score} & \textbf{Remarks} \\
    \midrule
    Phase 1 (APT)      & k-NN (k=10)             & 100.00 \%         & 100.00 \%         & Perfect separation on CTU-13. \\
    Phase 2 (DDoS)     & k-NN                    & 100.00 \%         & 100.00 \%         & Unified logset performed well. \\
    Phase 3 (Botnet)   & k-NN                    & 100.00 \%         & 100.00 \%         & CTU-13 botnet traces detected. \\
    Phase 4 (CICIDS)   & k-NN                    & 100.00 \%         & 100.00 \%         & Strong DoS Hulk and GoldenEye detection. \\
    \bottomrule
  \end{tabular}
\end{table}