## 5 Discussion
The CNN and DNN models each achieved 99.94% across all metrics, while the Autoencoder model scored slightly lower at 99.93%. On the NF-BoT-IoT-v2 dataset, the Autoencoder-CNN outperformed the Transformer-DNN, with slightly higher accuracy of 97.95% and precision, recall, and F1 scores of 97.97%, 97.95%, and 97.95%, respectively. The Transformer-DNN achieved accuracy of 97.90%, with precision, recall, and F1 scores of 97.98%, 97.90%, and 97.90%, respectively. The CNN model achieved 97.87% accuracy, with precision, recall, and F1 scores of 97.91%, 97.87%, and 97.87%, respectively. The DNN model achieved 97.83% accuracy, with precision, recall, and F1 scores of 97.88%, 97.83%, and 97.82%, respectively. The standalone Autoencoder scored 97.81% for accuracy, with precision, recall, and F1 scores of 97.87%, 97.81%, and 97.81%, respectively. These results underscore the effectiveness of integrating advanced architectures to enhance classification performance when using imbalanced datasets. The results also demonstrate the superiority of the Transformer-DNN and Autoencoder-CNN models in terms of reliable and efficient multi-class classification on both datasets. Figure 8: Confusion matrix for multi-class classification on the NF-BoT-IoT-v2 dataset using (**a**) Autoencoder–CNN and (**b**) Transformer–DNN. The Autoencoder-CNN model demonstrated exceptional performance in multi-class classification on the CICIDS2017 dataset, achieving remarkable accuracy and reliability across diverse attack categories, as detailed in Table 33. For certain classes such as FTP-Patator, SSH-Patator, infiltration, Web Attack--SqI Injection, and Heartbleed, the model achieved perfect scores in all metrics, including 100% accuracy, precision, recall, and F1 score, underscoring its capability to detect these threats flawlessly. For challenging attack types such as DoS Slowloris and DoS Slowhttptest, the model maintained robust performance with F1 scores of 99.78% and 99.36%, respectively. For classes like PortScan and DDoS, which often involve complex patterns, the model execled with F1 scores of 99.97% and 99.98%, respectively, indicating its effectiveness in handling intricate attack  
Figure 10: Proposed Transformer–DNN and Autoencoder–CNN versus multi-class classifiers on the NF-BoT-IoT-v2 dataset. Figure 9: Proposed Transformer–DNN and Autoencoder–CNN versus multi-class classifiers on the CICIDS2017 dataset. scenarios. Notably, F1 scores of 99.21% and 99.05% were achieved for Web Attack--Brute Force and Web Attack--XSS, reflecting the model's adeptress at identifying less frequent attack types. Overall, these comprehensive results affirm the Autoencoder-CNN model's robustness and suitability for real-world intrusion detection systems where precise and consistent performance is paramount. The Transformer-DNN model demonstrated exceptional performance in multi-class classification on the CICIDS2017 dataset, achieving outstanding metrics across various attack classes, as detailed in Table 34. The model achieved perfect scores for several categories, including DoS Hulk, DoS GoldenEye, SSH-Patator, Web Attack--XSS, infiltration, Web Attack--Sql Injection, and Heartbleed, with 100% accuracy, precision, recall, and F1 scores. These results underscore the model's ability to detect these attack types with complete reliability and no misclassifications. For other attack classes, such as DDoS and PortScan, the model maintained exceptional performance, achieving F1 scores of 99.95% and 99.97%, respectively. Strong metrics were also displayed for challenging attack types including DoS Slowloris and DoS Slowhttptest, with F1 scores of 99.78% and 99.68%, respectively. Additionally, FTP-Patator and Bot attacks were associated with F1 scores of 99.84% and 99.49%, demonstrating the model's capacity to handle diverse patterns of malicious behavior. Even for Web Attack--Brute Force, the model achieved an impressive F1 score of 99.21%.