## 4 Experimental Results
### Transformer Model Performance
The Transformer model achieved significantly superior metrics on the test set (average over the 5 cross-validation folds):  
* Accuracy (test): \(0.9998\pm 0.0001\)
* F1-score (macro, test): \(0.9944\pm 0.0032\)
* F1-score (weighted, test): \(0.9998\pm 0.0001\)  
The confusion matrix shown in Figure 12 demonstrates the excellent performance of the Transformer model on the test set. Unlike the MLP, the Transformer achieved almost perfect classification for all IPs, with high values on the diagonal and no systematic errors outside it. All classes, including those with fewer samples, were correctly identified, as reflected in the absence of significant values outside the main diagonal. This result indicates that the model is not only capable of learning distinctive patterns for the most frequent attackers but also generalizes well to minority classes, overcoming the bias observed in the MLP. The homogeneity along the diagonal of the matrix and the absence of relevant confusions demonstrate the robustness and discriminative capacity of the Transformer in multi-adversary and imbalanced scenarios. Together, these results explain the high macro and weighted F1-scores obtained on the test set and confirm that the Transformer can correctly attribute attacks to each IP, regardless of the attacker's frequency. Despite the Transformer model's exceptional performance (99.97% accuracy on the test set), a detailed analysis of the few misclassified sequences provides valuable insights into the model's behavior and the complexity of the attribution task. Out of 10,766 test sequences across the 5-fold cross-validation, only 3 sequences were incorrectly classified. Figure 11: Evolution of the F1-score per IP during training and validation of the Transformer model. It is important to note that the confusion matrix shown in Figure 12 corresponds to a single fold of the 5-fold cross-validation. In that particular fold, only one misclassification occurred. The total of three misclassifications refers to the aggregate across all five folds. Analysis of Misattributed Sequences  
Table 5 presents a detailed analysis of these three misattributed sequences, including their characteristics, the actual and predicted attacker IPs, and potential explanations for the classification errors. The analysis reveals several important patterns in the misattributed sequences. First, all three errors involved sequences with highly repetitive patterns, suggesting that the model may struggle with sequences that lack sufficient diversity to distinguish between similar attackers. Second, two of the three errors involved IPs from the same subnet (10.5.11.x), indicating potential confusion between attackers from the same team. Third, the misclassified sequences were relatively short (9-20 alerts) and may not have provided enough temporal context for accurate attribution. These findings highlight the importance of sequence diversity and length in attack attribution, as well as the challenge of distinguishing between attackers from the same  
Figure 12: Confusion matrix of the Transformer on the test set. \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Actual IP** & **Predicted IP** & **Sequence Length** & **Alert Pattern** & **Sequence Description** & **Potential Error Cause** \\ \hline
10.5.11.101 & 10.5.11.110 & 9 & & [15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 15, 14, 10,5.8.101 & 20 & [14, 2, 14, 2, 14, 2,...] & \
\begin{tabular}{l} Alternating TCP segments \\ and IMAP commands \\ \end{tabular} &
\begin{tabular}{l} Similar IP range (10.5.11.x) \\ with identical alert pattern \\ Pattern similarity across \\ different teams (teams 4 \\ and 8) \\ \end{tabular} \\
10.5.6.102 & 10.5.11.120 & 15 & [27, 13, 27, 13,...] & \
\begin{tabular}{l} Alternating HTTP methods \\ and invalid content \\ \end{tabular} &
\begin{tabular}{l} Cross-team pattern confusion \\ in HTTP-based attacks \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Analysis of misattributed sequences in the test set.