## 5 Discussion  
This section provides a comprehensive evaluation of the Autoencoder-CNN and Transformer-DNN models, benchmarking their performance against other classification techniques including CNN, Autoencoder, and DNN, across both binary and multi-class classification tasks. A detailed analysis of confusion matrices and performance metrics including accuracy, precision, recall, and F1 score highlights the comparative strengths and limitations of each approach. By focusing on results from the CICIDS2017 and NF-BoT-IoT-v2 datasets, we aim to demonstrate how the Autoencoder-CNN model, with its integration of Autoencoder and CNN architectures, and the Transformer-DNN model, with its combination of Transformer and DNN architectures, excel in detecting different classes. These integrations can contribute to measurable improvements in the detection and differentiation of diverse attack types, addressing key challenges in network intrusion detection. Through this in-depth discussion, we underscore the practical implications of our findings, particularly regarding the enhanced accuracy and reliability these models offer for intrusion detection systems in real-world applications. These results demonstrate the models' potential to improve both early threat detection and response, thereby elevating the overall robustness of modern cyber security solutions. (i) Binary Classification  
On the CICIDS2017 dataset, the Autoencoder-CNN and Transformer-DNN models exhibited exceptional performance in binary classification. The Autoencoder-CNN achieved accuracy, precision, recall, and F1 scores of 99.90%, correctly detecting 13,927 normal instances and 11,039 attack instances, while incorrectly detecting 14 normal instances and 10 attack instances. The Transformer-DNN outperformed these results slightly, achieving metrics of 99.92% and correctly detecting 13,930 normal instances and 11,039 attack instances, with 11 normal instances and 10 attack instances incorrectly detected. On the NF-BoT-IoT-v2 dataset, both models achieved identical metrics of 99.98% across accuracy, precision, recall, and F1 score. The Autoencoder-CNN and Transformer-DNN correctly detected 1263 normal instances and 10,795 attack instances, with 3 attack instances incorrectly detected, as shown in Figure 3. This high level of performance underscores the models' robustness, especially in handling imbalanced datasets such as are typical in real-world applications. The high precision and recall values demonstrate their reliability in detecting attacks while minimizing both false positives and false negatives, making them effective solutions for intrusion detection systems. The comparative performance of the Transformer-DNN and Autoencoder-CNN models in binary classification on the CICIDS2017 and NF-BoT-IoT-v2 datasets, as shown in Figures 4 and 5, demonstrates their outstanding effectiveness. With the CICIDS2017 dataset, the Transformer-DNN model exceled, achieving perfect scores across all metrics and 99.92% accuracy, precision, recall, and F1 score. The Autoencoder-CNN was close behind, attaining 99.90% across all metrics, reflecting its strong performance. The DNN model also performed well, achieving 99.88% in all metrics, while the CNN and Autoencoder models showed slightly lower results at 99.83% and 99.73%, respectively. With the NF-BoT-IoT-v2 \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Dataset** & **Metric** & **Accuracy** & **Precision** & **Recall** & **F-Score** \\ \hline \multirow{6}{*}{NF-BoT-IoT-v2} & CNN & 97.87\% & 97.91\% & 97.87\% & 97.87\% \\ \cline{2-6}  & Autoencoder & 97.81\% & 97.87\% & 97.81\% & 97.81\% \\ \cline{2-6}  & DNN & 97.83\% & 97.88\% & 97.83\% & 97.82\% \\ \cline{2-6}  & Autoencoder-CNN & 97.95\% & 97.97\% & 97.95\% & 97.95\% \\ \cline{2-6}  & Transformer-DNN & 97.90\% & 97.98\% & 97.90\% & 97.90\% \\ \hline \hline \end{tabular}
\end{table}