## 3 Research Methodology
### Dataset Generation
#### 3.1.1 CICIDS2017 Dataset Generation  
The CICIDS2017 dataset (see Figure 1) is extensively employed in the field of cybersecurity for the purposes of intrusion detection and network traffic analysis research [17]. The creation and release of the aforementioned project occurred in 2017 under the auspices of the Canadian Institute for Cybersecurity (CIC) at the University of New Brunswick, located in Canada [18]. The primary objective of the dataset is to offer a comprehensive range of network traffic scenarios that accurately reflect real-world conditions. This dataset serves as a means to assess the efficacy of intrusion detection systems (IDSs) and other cybersecurity algorithms in terms of their performance [19].  
The CICIDS2017 dataset contains a total of 78 columns representing various attributes related to transmission sessions, along with an additional column serving as the label. Some of the features of the dataset are presented in Table 1.  
The dataset encompasses both benign (non-malicious) and malicious network traffic. The category of malicious network traffic encompasses a range of network attacks that are classified under various labels, such as \"Bot,\" \"DDoS,\" \"DoS GoldenEye,\" \"DoS  
\begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline
**FD** & **FP** & **BP** & **LF** & **LB** & **FL** & **BL** & **FF** & **BB** & **PL** & **PP** \\ \hline
3 & 2 & 0 & 12 & 0 & 40 & 0 & 666,666.6667 & 0 & 6 & 6 \\ \hline
1022 & 2 & 0 & 12 & 0 & 40 & 0 & 1956.947162 & 0 & 6 & 6 \\ \hline
4 & 2 & 0 & 12 & 0 & 40 & 0 & 500,000 & 0 & 6 & 6 \\ \hline
42 & 1 & 1 & 6 & 6 & 20 & 20 & 23,809.52381 & 23,809.52381 & 6 & 6 \\ \hline
4 & 2 & 0 & 12 & 0 & 40 & 0 & 500,000 & 0 & 6 & 6 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Selected features from CICIDS2017 dataset.  
Figure 1: The snapshot of the CICIDS2017 dataset.  
Hulk,\" \"DoS Slow-httptest,\" \"DoS slowloris,\" \"FTP-Patator,\" \"Heartbleed,\" \"Infiltration,\" \"PortScan,\" \"SSH-Patator,\" \"Web Attack--Brute Force,\" and \"Web Attack--SQL Injection\". However, it should be noted that the dataset does not directly provide information about the malicious attack itself. Instead, it offers features that can be analyzed and used to infer the presence of an attack. What is the technique inferring or drawing conclusions on based on this characteristic? There exist two distinct methodologies for analyzing attacks in the dataset: manual extraction and automatic deduction.  
The manual method encompasses a procedure known as \"ground truth labeling\". The process of ground truth labeling entails the identification and annotation of individual instances of network traffic, classifying them as either benign or associated with a particular attack category. This is achieved through the utilization of expert knowledge and real-world attack data [30]. The establishment of the validity of the labeling (ground truth) study remains uncertain [31]. This uncertainty arises from the identification of a significant number of previously unrecorded errors throughout the entire process of creating the CIC-IDS 2017 and CSE-CIC-IDS 2018 datasets [31]. These errors encompass various stages such as attack orchestration, feature generation, documentation, and labeling.  
The application of an automated labelling process, which utilizes a combination of time and host-based filtering techniques, to effectively segregate malicious traffic has been widely implemented in various scenarios [30]. It was established that two cutting-edge methodologies were usually employed in the automatic approach, namely \"Confident Learning\" [32] and \"O2D-Net\" proposed by [PERSON] et al. [33], for the purpose of identifying inaccuracies in labeling within the domain of computer vision.