## 6 Limitations  
The Transformer-DNN and Autoencoder-CNN represent advanced hybrid deep learning architectures designed to enhance performance in both binary and multi-class classification tasks. While this approach addresses key challenges in intrusion detection systems, such as improving accuracy and managing class imbalances, several limitations and challenges remain to be addressed, including the following:  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Label** & **Accuracy** & **Precision** & **Recall** & **F-Score** \\ \hline \multirow{4}{*}{Autoencoder-CNN} & Reconnaissance & 95.53\% & 98.63\% & 95.53\% & 97.06\% \\ \cline{2-5}  & DDoS & 99.28\% & 99.38\% & 99.28\% & 99.33\% \\ \cline{2-5}  & DoS & 98.25\% & 95.81\% & 98.25\% & 97.01\% \\ \cline{2-5}  & Theft & 100\% & 96.88\% & 100\% & 98.41\% \\ \hline \multirow{4}{*}{Transformer-DNN} & Reconnaissance & 94.20\% & 99.85\% & 94.20\% & 96.94\% \\ \cline{2-5}  & DDoS & 99.28\% & 99.38\% & 99.28\% & 99.33\% \\ \cline{2-5}  & DoS & 99.15\% & 94.84\% & 99.15\% & 96.95\% \\ \cline{2-5}  & Theft & 100\% & 98.41\% & 100\% & 99.20\% \\ \hline \hline \end{tabular}
\end{table}
Table 35: Performance metrics for Autoencoder-CNN and Transformer–DNN across several classes in multi-class classification on the NF-BoT-IoT-v2 dataset.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Label** & **Accuracy** & **Precision** & **Recall** & **F-Score** \\ \hline PortScan & 99.94\% & 100\% & 99.94\% & 99.97\% \\ \hline DDoS & 100\% & 99.90\% & 100\% & 99.95\% \\ \hline DoS Hulk & 100\% & 100\% & 100\% & 100\% \\ \hline DoS GoldenEye & 100\% & 100\% & 100\% & 100\% \\ \hline FTP-Pataotr & 99.67\% & 100\% & 99.67\% & 99.84\% \\ \hline SSH-Pataotr & 100\% & 100\% & 100\% & 100\% \\ \hline DoS Slowloris & 100\% & 99.56\% & 100\% & 99.78\% \\ \hline DoS Slowhrtptest & 99.36\% & 100\% & 99.36\% & 99.68\% \\ \hline Bot & 98.99\% & 100\% & 98.99\% & 99.49\% \\ \hline Web Attack—Brute Force & 100\% & 98.44\% & 100\% & 99.21\% \\ \hline Web Attack—XSS & 100\% & 100\% & 100\% & 100\% \\ \hline Infiltration & 100\% & 100\% & 100\% & 100\% \\ \hline Web Attack—Sql Injection & 100\% & 100\% & 100\% & 100\% \\ \hline Heartbleed & 100\% & 100\% & 100\% & 100\% \\ \hline \hline \end{tabular}
\end{table}
Table 34: Performance metrics for Transformer–DNN across several classes in multi-class classification on the CICIDS2017 dataset.  
* Scalability: As dataset sizes and the complexities of network traffic increase, computational requirements may escalate, potentially affecting the models' efficiency and ability to handle larger datasets or adapt to evolving network environments.
* Generalization: While the Transformer-DNN and Autoencoder-CNN demonstrated strong performance on the CICIDS2017 and NF-BoT-IoT-v2 datasets, their effectiveness on different types of network traffic or emerging attack vectors remains uncertain. Evaluating the models on a broader range of datasets, such as NSL-KDD, KDDCup99, UNSW-NB15, or newer ones like CSE-CIC-IDS2018 and NF-ToN-IoT-v2, is essential to gauge their robustness and generalization capability.
* Data Preprocessing: Implementing data preprocessing on different datasets is a critical step that involves tasks such as handling missing values, encoding categorical variables, normalizing or standardizing numerical features, and removing irrelevant information. The effectiveness of the models depends heavily on how well these preprocessing steps are executed.
* Model Adaptation: Adapting the models to different datasets involves a trial-and-error process for hyperparameter optimization. This process is crucial for fine-tuning the models to align with the characteristics of new datasets.