## 3 Proposed Framework for Intelligent Cyber Security
### Handling Imbalanced and Overlapped Data  
The learning that is based upon the imbalanced data will give a powerful connection between the overlap and the class imbalance. The most critical steps in overcoming major cyber security issues are to deal with handling imbalance and overlapped data. When it comes to malware detection, domain reputation, or detecting network intrusion, unbalanced datasets are the most common. A model claiming \"everything is harmless\" may improve accuracy, but it will be useless since an uneven dataset is not discovered. The unbalanced difficulty is not unique to cyber security, but it is a key component of many cyber security issues. Using the given training inputs, the performance level is not achieved because of the large values of overlap and imbalance states. To remove the detrimental effects of the imbalance and overlap data, this work has developed a random over sample-based DBSCAN to overcome the imbalance and overlap data issues. The technique developed initially separates the overlapped data points into various clusters and thereafter, based on the count, the balancing of the class is performed. The developed approach helps to remove the noisy data points and handle the uncertain data in the ground truth. Initially, density-based clustering is performed based on the data points. The approach depends upon the two parameters that are minimum points (MinPts) and Eps. The Epsilon (\(\varepsilon\)) states the radius of a circle by considering data from the dataset. MinPts illustrates the point that satisfies the user condition to form a dense cluster or region over data. Now, based on the Eps and MinPts, the important points formed are core points, boundary points, and noise points. A data point is said to be the core point if it satisfies the MinPts within the Eps distance. A data point is said to be a boundary point if it is a neighbour of the core point. Finally, if no points lie nearer to the core or boundary point, then it is said to be a noise point. The data points are chosen randomly for detecting whether they are core points, boundary points, or noise data. This may lead to high computation time along with a high error rate. This work used the Deterministic Initialization Method (DIM) for selecting optimal data points. \[\begin{array}{l}for\,i=0:(D-1)\\ \quad\quad\quad\quad\quad\quad\quad\quad\quad\quad\quad\quad\quad\quad\quad \quad\quad\quad\quad\quad\quad\quad\quad\quad\quad\quad\quad\quad\quad\quad \quad\quad\quad\quad\quad\  
In the Equation (6), \(C^{*}(i+1)\) represents the optimal clusters point, \(ub\) and \(lb\) denotes the upper bound and lower bound, whose values ranges between [0, 1]. Now, core point (\(\forall^{\alpha}\)), boundary point (\(B^{\alpha}\)), and noise point are computed based on Euclidean distance for the optimal data point. The data point is checked by drawing a circle of distance \(\varepsilon\) and a condition of satisfying the MinPts using Euclidean distance that is computed by the Equations (7) and (8):  
\[\forall^{\varepsilon}\Big{[}S\Big{(}C_{i,j}^{*}\Big{)}\Big{]}=\sqrt{\big{(}C_ {l}^{1}-C_{m}^{1}\big{)}^{2}+\big{(}C_{l}^{2}-C_{m}^{2}\big{)}^{2}+\ldots\big{(} C_{l}^{n}-C_{m}^{n}\big{)}^{2}} \tag{7}\]  
\[B^{\varepsilon}\Big{[}S\Big{(}C_{i,j}^{*}\Big{)}\Big{]}=\sqrt{\big{(}B_{l}^{1 }-\forall_{m}^{1}\big{)}^{2}+\big{(}B_{l}^{2}-\forall_{m}^{2}\big{)}^{2}+ \ldots\big{(}B_{l}^{n}-\forall_{m}^{n}\big{)}^{2}} \tag{8}\]  
The data cluster \(\big{(}C_{K}^{l}\big{)}\) is formed based on the core point and boundary points. The noisy data or outliers are stated as \((c^{+})\). Finally, the overlapped classes are separated, and a standard dataset is obtained B\({}_{data}\). Now, the count of the classes is taken. If the classes are in an imbalanced proportion, then a random over sampler is performed. The ROS helps to pick up a sample of records from a dataset by improving the balancing rate. The random over sampler performs a copy of a set of data (B\({}_{data}\)) that are minorly distributed (\(\alpha_{minority}\)) in a dataset.