## 2 Related Works  
The CIC-IDS2017 dataset is a well-known benchmark dataset for Intrusion Detection Systems (IDS). It contains network traffic data collected from real-world environments with different types of attacks and normal traffic. The initial dataset consisted of 79 features and 15 classes (one benign, 14 malicious). To enhance the classification performance of this dataset, numerous studies have been conducted, incorporating detailed analyses such as feature selection, class grouping, data cleaning, and processing. For this task, a wide range of classifiers have been employed, including classical methods, such as Random Forest RF [27; 28] and MLP (multi-layer perceptron) [13; 28] as well as deep learning architectures [29; 30; 31; 32; 33]. Table 1 presents the results of specific multi-class classification studies, displaying the _F1-score_ and the corresponding number of classification classes. The majority of the results demonstrated an accuracy exceeding 90%, regardless of whether the classification involved 15 or fewer classes. Due to class imbalance, which is prevalent in the CIC-IDS2017 dataset and numerous other cybersecurity datasets, one class, specifically Benign, dominates the others, accounting for 80.3% of the raw data. To tackle this issue, various approaches have been employed, resulting in variations in the number of classes across different studies. Methods such as resampling [12], ensemble learning [34] or employing simple binary classification [9; 34] have been frequently utilized in addressing class imbalance. One of the main issues encountered in the CIC-IDS2017 dataset is the incorrect aggregation of packets into streams, primarily caused by inadequate protocol detection. This problem has an impact on the number of classes or attributes within the dataset [35; 36]. As a result, flows in the dataset may be too short or too long or may consist of packets from different conversations, resulting in inaccurate flow attributes. In addition, there are problems with TCP session termination in the dataset, so similar flows may have different labels. The presence of inaccurate flow attributes resulting from incorrect packet aggregation can introduce complexities that may confuse machine learning algorithms, consequently rendering the detection of network intrusions more challenging. The CSE-CIC-IDS-2018 dataset contains a total of 28 classes of network traffic, each representing a different type of network activity. However, in classification tasks, these classes are often aggregated into 7 groups, namely \"Benign\", \"DDoS\", \"DoS\", \"Brute Force\", \"Bot\", \"Infiltration\", and \"Web.\" Occasionally, the classes are collapsed into 10 groups, and the maximum number of classes observed for classification is 14, as depicted in Table 2. \begin{table}
\begin{tabular}{l l c c} \hline \hline
**Method** & \multicolumn{1}{c}{**Classifier**} & \multicolumn{1}{c}{**F1-Score, (\%)**} & \multicolumn{1}{c}{**Classes**} \\ \hline [PERSON] [27] & ANN & 96.53 & \\  & RF & 96.24 & \\ \hline [PERSON] et al. [28] & RF & 98.36 & \\  & MLP & 80.63 & \\  & Naive Bayes (NB) & 90.82 & \\ \hline [PERSON] et al. [29] & LSTM & 98.65 & \\  & 4 layers CNN & 98.98 & 15 \\ \hline [PERSON] [30] & SGM-CNN & 96.36 & 15 \\ \hline [PERSON] et al. [31] & PCA+RF & 99.60 & 15 \\ \hline [PERSON] et al. [32] & 8 hidden layers DenseNet & 94.10 & 13 \\ \hline [PERSON] [33] & Parallel cross convolutional neural network (PCCN) & 99.68 & 12 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Multi-classification accuracy results for the CIC-IDS2017 dataset.