## 4 Results and Experiments
### Dataset Description and Preprocessing Overview
#### 4.1.2 CICIDS2017 Dataset  
Certain aspects, such as data structure and labeling, are pivotal for effective intrusion detection in network-based datasets. [PERSON] et al. [97] offer a thorough analysis of these factors in both supervised and unsupervised intrusion detection techniques. This section delves into the history and characteristics of the CICIDS2017 dataset, which is utilized in this study for intrusion detection. Released by the Canadian Institute for Cybersecurity, this dataset is publicly available for academic research purposes [98]. It is one of the most up-to-date datasets for network intrusion detection found in the literature, comprising 2,830,743 records, 79 network traffic features, and 15 classes, including 1 for Benign traffic \begin{table}
\begin{tabular}{c c c} \hline \hline
**Parameter** & **Binary Classifier** & **Multi-Class Classifier** \\ \hline Batch size & 128 & 128 \\ \hline \multirow{4}{*}{Learning rate} & Scheduled: Initial = 0.001, & \multirow{2}{*}{
\begin{tabular}{} \end{tabular} } \\  & Factor = 0.5, Min = 1 \(\times\) 10\({}^{-5}\) & Factor = 0.5, Min = 1 \(\times\) 10\({}^{-5}\) \\  & (ReduceLROnPlateau) & (ReduceLROnPlateau) \\ \hline Optimizer & [PERSON] \\ \hline Loss function & Binary cross-entropy & Categorical\_crossentropy \\ \hline Metric & Accuracy & Accuracy \\ \hline \hline \end{tabular}
\end{table} 
Table 31: Hyperparameters of the Transformer-CNN model. and 14 distinct attack types [12]. The dataset is organized into eight files representing five days of benign and attack traffic, with each file containing real-world network data [98; 99]. In addition to the core traffic data, the records include supplementary metadata and are provided in packet-based and bifacial flow-based formats [97]. The dataset is fully labeled, making it suitable for both binary and multi-class classification tasks. For binary classification, all attack types are labeled as '1', while benign traffic is labeled as '0'. For multi-class classification, all attack types are considered individually, providing a comprehensive view of the different forms of network attacks. The CICIDS2017 dataset, while extensive, requires meticulous preprocessing to address missing data and enhance its quality for analysis. Preprocessing began by consolidating the dataset's eight constituent files into a single comprehensive dataset. Missing values, or NaNs, were systematically addressed to prevent data quality issues. Duplicates were eliminated, and columns with only a single unique value were removed to optimize feature relevance. Remaining NaN values were carefully imputed, and feature names were standardized by stripping leading spaces for uniformity. Sampling was then performed, and for multi-class classification, instances belonging to the 'Normal' class were excluded post-sampling. To eliminate extreme values that could bias model outcomes, outliers were identified and removed using the LOF. In multi-class classification, feature selection based on correlation is applied following outlier removal to refine the feature set further. Then, numerical features are normalized using MinMaxScaler to ensure consistent scaling across variables. After these steps, the dataset was partitioned into training and testing subsets. To address class imbalances during training, advanced resampling techniques were implemented. For binary classification, the enhanced hybrid ADASYN-SMOTE method was applied to generate synthetic samples within the training data, while for multi-class classification, an advanced cascaded SMOTE approach was utilized to balance the training dataset effectively. Additionally, the ENN technique was employed to undersample the training data, further refining class distribution and improving model robustness. Class weights were dynamically adjusted during the training process to ensure balanced learning across all classes.