## 4 Experimental Results
### MLP Model Performance (Baseline)  
To establish a clear and quantifiable reference for the task of attack attribution in multi-adversary environments, we implemented an MLP classifier as a baseline. This subsection aims to demonstrate the limitations of traditional approaches and justify the need for more advanced models, such as the Transformer, in scenarios characterized by high complexity and class imbalance.  
The MLP was designed to process alert sequences represented as integer vectors, where each alert is transformed into a learned embedding. The entire sequence was flattened and fed into a deep neural network with several hidden layers. The specific configuration of the model was as follows:  
* Embedding layer: 64-dimensional embedding for each alert.
* Network structure: three hidden layers with 1024, 512, and 256 neurons, respectively, each followed by ReLU activation, batch normalization, and dropout (0.2).
* Input: sequences of lengths between 9 and 243 alerts, padded to the maximum length.
* Loss function: cross-entropy with class weights inversely proportional to class frequency to mitigate imbalance.
* Optimizer: Adam, initial learning rate 0.001.
* Training: early stopping with patience of 20 epochs; batch size 128; data split into 60% training, 20% validation, and 20% test.  
This architecture allowed for a fair and reproducible comparison against more sophisticated models and helped to gauge the challenge posed by attribution in this context. Figure 8 shows the evolution of the F1-score for the five best classified IPs by the model throughout the training epochs. The MLP quickly learned to identify majority classes, achieving high precision, recall, and F1-score within a few epochs and maintaining them close to 1.0. These IPs--10.5.11.110, 10.5.7.101, 10.5.11.114, 10.5.2.101, and 10.5.19.111--achieved consistently high performance, with F1-scores converging toward 1.0 as training progressed. This highlights the model's ability to generalize well for frequent or well-represented attacker classes.  
The results obtained by the MLP on the test set reflect the limitations of this approach. The macro F1-score was considerably lower than the weighted F1-score, indicating that the  
Figure 8: F1-score evolution for the 5 best and 5 worst IPs in the MLP during training.  
model tended to favor majority classes and struggled to generalize to minority ones. The main metrics were  
* Accuracy: 0.8062
* F1-score (macro): 0.6505
* F1-score (weighted): 0.8048.  
The confusion matrix shown in Figure 9 reinforces this diagnosis. The model correctly identified several of the IPs with the largest number of samples, such as 10.5.1.110, 10.5.8.101, 10.5.10.104, 10.5.17.101, and 10.5.9.102, which showed high values on the diagonal. However, performance dropped significantly for certain classes, such as 10.5.8.101 misclassified as 10.5.9.102, 10.5.17.101 as 10.5.16.101, and 10.5.6.107 as 10.5.6.108, where the model frequently confused similar patterns. In these cases, most examples were assigned to neighboring or semantically related classes, rather than being rarely classified correctly. This reflects a systematic bias and the MLP's difficulty in learning distinctive patterns in overlapping or imbalanced scenarios. This error pattern was not random but concentrated in specific classes (attackers), indicating a bias toward classes with greater support. This phenomenon was consistent with the low macro F1-score, which penalized the inability to generalize to minority classes. Overall, these results show that while the MLP can be effective at identifying frequent attackers, its ability to discriminate among multiple adversaries in imbalanced scenarios is moderate, and it tends to systematically confuse closely related attackers.