## 5 Discussion
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Dataset** & **Model** & **Label** & **Accuracy** & **Precision** & **Recall** & **F-Score** \\ \hline \multirow{4}{*}{CICIDS2017} & \multirow{2}{*}{Autoencoder-CNN} & Normal & 99.90\% & 99.93\% & 99.90\% & 99.91\% \\ \cline{3-6}  & & Attack & 99.91\% & 99.87\% & 99.91\% & 99.89\% \\ \cline{3-6}  & \multirow{2}{*}{Transformer–DNN} & Normal & 99.92\% & 99.93\% & 99.92\% & 99.92\% \\ \cline{3-6}  & & Attack & 99.91\% & 99.90\% & 99.91\% & 99.90\% \\ \hline \multirow{4}{*}{NF-BoT-IoT-v2} & \multirow{2}{*}{Autoencoder-CNN} & Normal & 100\% & 99.76\% & 100\% & 99.88\% \\ \cline{3-6}  & & Attack & 99.97\% & 100\% & 99.97\% & 99.99\% \\ \cline{2-6}  & \multirow{2}{*}{Transformer–DNN} & Normal & 100\% & 99.76\% & 100\% & 99.88\% \\ \cline{3-6}  & & Attack & 99.97\% & 100\% & 99.97\% & 99.99\% \\ \hline \hline \end{tabular}
\end{table} 
Table 32: Performance metrics for Autoencoder–CNN and Transformer–DNN in binary classification across several classes. the model classified 305 instances of FTP-Patator, with just 1 instance incorrectly labeled as DoS Slowloris. Additionally, for more challenging attack types, such as DoS Slowloris and Web Attack-Brute Force, the model achieved perfect accuracy, correctly identifying all 228 instances of DoS Slowloris and all 63 instances of Web Attack-Brute Force, with no misclassifications. The Web Attack-SQL Injection, Infiltration, and Heartbleed attack classes were all perfectly identified, with 100% precision, recall, and F1-scores. The model also exhibited strong performance across less frequent classes like Bot, with only 1 misclassification out of 99 instances, showcasing its ability to handle imbalanced datasets effectively. With an overall accuracy of 99.96%, precision of 99.96%, recall of 99.96%, and F1-score of 99.96%, these results highlight the Transformer-DNN model's robust ability to manage multi-class classification challenges, making it a reliable candidate for real-world intrusion detection systems where precision and accuracy in classifying diverse attack types are essential. Figure 6: Confusion matrix for multi-class classification using Autoencoder-CNN on the CI-CIDS2017 dataset. The Autoencoder-CNN and Transformer-DNN models demonstrates impressive performance in multi-class classification on the NF-BoT-IoT-v2 dataset. The Autoencoder-CNN achieved an overall accuracy of 97.95%, with precision, recall, and F1 score values of 97.97%, 97.95%, and 97.95%, respectively. The Autoencoder-CNN correctly identifies 2670 instances of Reconnaissance, 4154 instances of DDoS, 3475 instances of DoS, and 62 instances of Theft. The Transformer-DNN, with a slightly lower accuracy of 97.90%, achieved precision, recall, and F1 score values of 97.98%, 97.90%, and 97.90%, respectively. It correctly identifies 2633 instances of Reconnaissance, 4154 instances of DDoS, 3507 instances of DoS, and 62 instances of Theft. Both models misclassified some instances among the classes, as shown in Figure 8. Both models effectively minimized false positives and false negatives, demonstrating their robustness in real-world applications, especially when handling the complexities of imbalanced datasets. Figure 7: Confusion matrix for multi-class classification using Transformer–DNN on the CI-CIDS2017 dataset. The comparative performances of the proposed Transformer-DNN and Autoencoder-CNN models against other multi-class classifiers demonstrates their exceptional capability in handling complex classification tasks on the CICIDS2017 and NF-BoT-IoT-v2 datasets, as shown in Figures 9 and 10. The evaluation metrics, including accuracy, precision, recall, and F1 score, highlight the outstanding performance of both models. On the CICIDS2017 dataset, the Transformer-DNN achieved the highest scores across all metrics, with an impressive 99.96% accuracy, precision, recall, and F1 score. The Autoencoder-CNN model followed closely with scores of 99.95% in each metric.