## 3 ENN
### Architectures of Models
#### 3.3.4 Autoencoder-Convolutional Neural Network (Autoencoder-CNN)
\[P_{i,j}=max\left(X_{xi+p,\ jj+q}\right) \tag{28}\]  
where \(P\) represents the output resulting from the pooling process; \(p\) and \(q\) denote the dimensions of the pooling window applied to aggregate the input features into the pooled output. The dropout layer serves as a regularization technique by randomly deactivating a fraction p of the input units during training. This randomness prevents the model from relying too heavily on any particular input feature, thereby reducing the risk of overfitting. As a result, the model is encouraged to learn more robust and generalized patterns. The impact of this regularization process is mathematically described in Equation (29) [52]. \[\text{Dropout(x)}=\left\{ \begin{array}{l}x\text{ {with probability}}\;1-p\\ 0\text{ {with probability}}\;p\end{array} \right. \tag{29}\]  
For binary classification tasks, the output layer utilizes the sigmoid function to produce a probability score that indicates the likelihood of an instance belonging to the positive class. This function outputs a value between 0 and 1, with values near 1 indicating a stronger likelihood of the instance being classified as positive, while values closer to 0 suggest a lower probability. The mathematical representation of this process is shown in Equation (30) [53]. \[\sigma\left(Z\right)=\frac{1}{1+e^{-z}} \tag{30}\]  
where \(Z\) denotes the result produced by the last dense layer in the network. The output layer employs the softmax function for multi-class classification, converting the raw outputs from the model into a probability distribution across all potential classes. This transformation ensures that the probabilities for each class sum to one, effectively representing the model's level of certainty regarding each class. The mathematical representation of this operation is given in Equation (31) [53]. \[\text{ {Softmax}}\left(Z_{i}\right)=\frac{e^{z_{i}}}{\sum\limits_{j}e^{z_{i}}} \tag{31}\]  
where \(Z_{i}\) represents the output from the final dense layer for class \(i\). (i) Binary ClassificationThe architecture outlined in Table 21 describes an Autoencoder-CNN model de-signed for binary classification on the CICIDS2017 and NF-BoT-IoT-v2 datasets. The model begins with an input layer, processing 69 features for the CICIDS2017 dataset and 18 features for the NF-BoT-IoT-v2 dataset. The encoder block employs a dense layer with 64 neurons and ReLU activation to learn compressed representations of the input data. The decoder block features a dense layer with a size matching the Autoencoder input and a linear activation function to reconstruct the original input. The output of the Autoencoder is then fed into the CNN, which begins with a 1D CNN layer comprising 256 filters and ReLU activation, followed by a 1D max pooling layer with a pool size of 2. To prevent overfitting, a dropout layer with a minimal rate of 0.00000001 is included. The second hidden block mirrors this structure, with a pool size of 4 in the max pooling layer. The third hidden block features a dense layer with 256 neurons and ReLU activation, followed by another dropout layer. Finally, a single neuron output layer with a sigmoid activation function produces a probability score, enabling effective binary classification of inputs. 2. Multi-Class Classification  
The architecture described in Table 22 details the Autoencoder-CNN model designed for multi-class classification on the CICIDS2017 and NF-BoT-IoT-v2 datasets. The model begins with an input block that processes 69 features for CICIDS2017 and 28 features for NF-BoT-IoT-v2. The encoder block consists of a dense layer with 64 units activated by ReLU, compressing the input data into a lower-dimensional representation. The decoder block mirrors this structure, employing a dense layer with the same size as the Autoencoder input and a linear activation function to reconstruct the original features. The output of the Autoencoder serves as the input to the CNN segment. The CNN segment begins with an input block that directly utilizes the output of the Autoencoder as its input.