# FPE-Transformer: A Feature Positional Encoding-Based Transformer Model for Attack Detection
## 3 Materials and Methods  
### Datasets  
In this study, the well-known CIC-IDS2017 and NSL-KDD datasets were used to validate the FPE-Transformer model. CIC-IDS2017 was created by the Canadian Institute for Cybersecurity (CIC) in Canada [60]. This dataset contains traffic recorded in a network environment with a speed of 10 Gbps for one week in 2017 (10-15 July 2017). During the data collection process, various user profiles were created that mimic real user behavior. The sample numbers according to the attack type of the CIC-IDS2017 dataset, which covers various network protocols such as HTTP, HTTPS, FTP, SSH, and SMTP, and consists of a total of 2,672,997 traffic samples, are as shown in Table 3.  
The NSL-KDD dataset is an enhanced variant of the KDD-CUP-99 dataset, with redundant and duplicate entries eliminated [61]. The dataset includes normal and anomalous network traffic, organized into training and testing subsets. The training subset comprises 125,972 samples, whereas the testing subset contains 22,543 samples. The label and sample counts of the NSL-KDD+train dataset are shown in Table 4, and Table 5 presents the comparative sample counts of the NSL-KDD train and test data according to attack categories. \begin{table}
\begin{tabular}{c c c} \hline
**Reference** & **Type** & **Dataset** \\ \hline
[13] & Attention-based & Public financial transaction records, synthetic data, anonymized data from financial institutions \\
[36] & Attention-based & Kaggle SQL injection, Kaggle XSS, DeepXSS, Cross-Site-ScriptingXSS \\
[37] & Attention-based & NetML, CICIDS2017, CICDDoS2019 \\
[38] & Attention-based & Car Hacking \\
[39] & Attention-based & CICIDS-2017 \\
[40] & Attention-based & CIC-IDS 2017, UNSW-NB15, Kitsune \\
[41] & Attention-based & ToN JoC \\
[42] & Attention-based & NSL-KDD \\
[43] & CNN–Transformer & KDDCup99, NSL-KDD, CICIDS-2017 \\
[44] & CNN–Transformer & CICIDS-2018 \\
[45] & CNN–Transformer & CICDDoS2019, CSE CIC-IDS2018 \\
[46] & CNN–Transformer & CICDDoS2019 \\
[47] & LSTM–Transformer & IEEE-14 Bus System (FDI Attacks) \\  & & UNSW-NB15, KDDCup99, NSL-KDD, CICIDS-2017 \\
[50] & ViT & IDS 2017, IDS 2012 \\
[51] & ViT & CICIDS2017, UNSW-NB15 \\
[52] & ViT & CICIDS2017 \\
[53] & GAN–Transformer & CSE-CIC-IDS2018, NF-ToN-IoT-V2, NF-UNSW-NB15-v2 \\
[54] & GAN\&ViT & CICIDS-2017 \\
[55] & RTIDS & CICIDS2017, CIC-DdoS2019 \\
[56] & BERT&DL Techniques & FWAF, CSIC2010, HttpParams \\
[57] & LightGBM\&Transformer & IoT, IoMT, Windows Malware \\
[58] & Improved Transformer & NSL-KDD, UNSW-NB15 \\
[59] & IDS-INT & UNSW-NB15, CICIDS2017, NSL-KDD \\ \hline \end{tabular}
\end{table} 
Table 2: Transformer models for attack detection applications. \begin{table}
\begin{tabular}{c c} \hline \hline
**Label** & **Sample Count** \\ \hline benign & 67,342 \\ neptune & 41,214 \\ satan & 3633 \\ ipsweep & 3599 \\ portsweep & 2931 \\ smurf & 2646 \\ nmap & 1493 \\ back & 956 \\ teardrop & 892 \\ warezclient & 890 \\ pod & 201 \\ guess\_passwd & 53 \\ buffer\_overflow & 30 \\ warezmaster & 20 \\ land & 18 \\ imap & 11 \\ rootkit & 10 \\ loadmodule & 9 \\ ftp\_write & 8 \\ multihop & 7 \\ phf & 4 \\ perl & 3 \\ spy & 2 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: NSL-KDD\(+\)train label and total sample counts. \begin{table}
\begin{tabular}{c c} \hline \hline
**Label** & **Sample Count** \\ \hline Benign & 2,203,723 \\ DoS Hulk & 231,073 \\ Port Scan & 158,930 \\ DoS GoldenEye & 10,293 \\ DDoS & 41,835 \\ FTP-Patator & 7938 \\ SSH-Patator & 5897 \\ DoS slowloris & 5796 \\ DoS Slowhttptest & 5499 \\ Bot & 1966 \\ Infiltration & 36 \\ Heartbleed & 11 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: CIC-IDS2017 label and total sample counts. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Category** & **Attack Types** & **Train Sample Count** \\ \hline Normal & normal & 67,342 \\ DoS &
\begin{tabular}{c} neptune, smurf, \\ back, teardrop, pod, \\ land \\ \end{tabular} & 50,943 & 5780 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Number of samples in training and test datasets according to attack types.