## 5 Discussion

Table 31: _Cont._dataset, both the Transformer-DNN and Autoencoder-CNN models achieved flawless performance, with 99.98% across all metrics, highlighting their excellent ability in binary classification tasks. The DNN model trailed slightly with a score of 99.96%, while the CNN and Autoencoder models achieved 99.97% and 99.94%, respectively. These results further emphasize the exceptional classification capabilities of the Transformer-DNN and Autoencoder-CNN models, proving their suitability for real-world application in intrusion detection, particularly when dealing with imbalanced datasets. The performance metrics in Table 32 highlight the exceptional effectiveness of the Autoencoder-CNN and Transformer-DNN models for binary classification across different classes within the CICIDS2017 and NF-BoT-IoT-v2 datasets. With the CICIDS2017 dataset,  
Figure 3: Confusion matrices for binary classification: (**a**) Autoencoder–CNN on the CICIDS2017 dataset, (**b**) Transformer-DNN on the CICIDS2017 dataset, (**c**) Autoencoder-CNN on the NF-BoT-IoT-v2 dataset, and (**d**) Transformer–DNN on the NF-BoT-IoT-v2 dataset. the Autoencoder-CNN achieved an accuracy of 99.90% for the Normal class, with precision of 99.93%, recall of 99.90%, and an F1 score of 99.91%. For the Attack class, it attained an accuracy of 99.91%, precision of 99.87%, recall of 99.91%, and an F1 score of 99.89%. The Transformer-DNN slightly outperformed this, with 99.92% accuracy for the Normal class, achieving a precision of 99.93%, recall of 99.92%, and an F1 score of 99.92%. For the Attack class, it reached 99.91% accuracy with metrics of 99.90% precision, 99.91% recall, and 99.90% F1 score. With the NF-BoT-IoT-v2 dataset, both models demonstrated outstanding performance, highlighting their robustness and effectiveness in intrusion detection. The Autoencoder-CNN and Transformer-DNN models achieved 100% accuracy for the Normal class, with precision of 99.76%, recall of 100%, and F1 score of 99.88%. For the Attack class, both models delivered accuracy of 99.97%, achieving 100% precision, 99.97% recall, and an F1 score of 99.99%. These metrics showcase the balanced performance of the Autoencoder-CNN and Transformer-DNN models across classes, making them highly effective for real-world intrusion detection scenarios  
a Web Attack--Brute Force. The model also excelled in classifying rare attack types like Web Attack--Brute Force or Web Attack--XSS, infiltration, Web Attack--SqI Injection, and Heartbleed, all with no misclassifications. The confusion matrix highlights the model's ability to handle both frequent and rare attack types with minimal errors, demonstrating its effectiveness in addressing multi-class classification challenges, particularly in imbalanced datasets. These results validate the model's potential for real-world intrusion detection systems, where both high accuracy and the ability to distinguish among diverse attack types are essential. In multi-class classification on the CICIDS2017 dataset, the Transformer-DNN model demonstrates exceptional performance, achieving outstanding accuracy, precision, recall, and F1-scores across multiple attack classes. As illustrated by the confusion matrix in Figure 7, the model effectively distinguishes between various attack types with minimal misclassifications. For instance, the model correctly identified all 1811 instances of PortScan, with only 1 misclassification, where it was classified as DDoS, and accurately classified all 2025 instances of DDoS and 5468 instances of DoS Hulk, with no misclassifications. For DoS GoldenEye, the model correctly classified 536 instances without errors, and similarly,  
Figure 5: Proposed Transformer–DNN and Autoencoder–CNN versus binary classifiers, on the NF-BoT-IoT-v2 dataset.