# A Comparative Analysis of the TDCGAN Model for Data Balancing and Intrusion Detection
## 3 Experiments Setup
### Feature Selection  
In our feature selection process, Principal Component Analysis (PCA) plays a crucial role. PCA helps identify and retain the most important features by transforming the original variables into a new set of uncorrelated variables, called principal components. By reducing the dimensionality of the data while preserving as much variance as possible, PCA enables us to streamline the computational load and enhance model performance [28]. Through PCA, we extract the key patterns and structures inherent in the data, empowering our subsequent analysis and modeling efforts with a focused and optimized feature set. Table 1 illustrates the top numerical features of each dataset based on their PCA values.  
To enhance the reliability of our comparison, we divided each sample of dataset into two parts: the first 70% served as the training set, while the remaining 30% constituted the testing set.  
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**Dataset** & \multicolumn{2}{c}{**Original Features**} & \multicolumn{2}{c}{**Selected Features**} \\ \hline  & Benign & 2,273,097 & Benign & 2,273,097 \\  & DOS Hulk & 231,073 & DOS Hulk & 231,073 \\  & PortScan & 158,930 & PortScan & 158,930 \\  & DDos & 128,027 & DDoS & 128,027 \\  & DOS GoldenEye & 10,293 & DOS GoldenEye & 10,293 \\  & FTP-Patator & 7938 & FTP-Patator & 7938 \\  & SSH-Patator & 5879 & SSH-Patator & 5879 \\ CIC-IDS2017 & DoG-slowloris & 5796 & DoG-slowloris & 5796 \\  & DCoS blowttptest & 5499 & DoG slowhttptest & 5499 \\  & Bot & 1966 & Bot & 1966 \\  & Web Attack Brute Force & 1507 & Other Attack & 2227 \\  & Web Attack XSS & 652 & & \\  & Infiltration & 367 & & \\  & Web Attack Sql Injection & 21 & & \\  & Heartbleed & 11 & & \\ \hline  & Benign & 1,222,612 & Benign & 1,222,612 \\  & DDOS attack-HOIC & 137,157 & DDOS attack-HOIC & 137,157 \\  & DOS attack-Hulk & 92,325 & DOS attack-Hulk & 92,325 \\  & Bot & 57,067 & Bot & 57,067 \\  & FIT-Burteforce & 38,881 & FTP-Burteforce & 38,881 \\  & SSH-Burteforce & 37,403 & SSH-Burteforce & 37,403 \\  & Infiltration & 32,470 & Infiltration & 32,470 \\  & DOS attacks-SlowHTTPest & 27,902 & DOS attacks-SlowHTTPest & 27,902 \\  & DOS attacks-GoldenEye & 8284 & DOS attacks-GoldenEye & 8284 \\  & DDOS attack-LOIC-UDP & 343 & DOS attacks-Slowloris & 2216 \\  & Burte Force-Web & 113 & Other Attacks & 533 \\  & Burte Force-XSS & 49 & & \\  & SQL Injection & 16 & & \\  & Label & 12 & & \\ \hline  & Smrf & 2,807,886 & Smrf & 2,807,886 \\  & Neptune & 1,072,017 & Neptune & 1,072,017 \\  & Normal & 972,780 & Normal & 972,780 \\  & Satan & 15,892 & Satan & 15,892 \\  & Ipsweep & 12,481 & Ipsweep & 12,481 \\  & Portsweep & 10,413 & Portsweep & 10,413 \\  & Nmap & 2316 & Nmap & 2316 \\  & back & 2203 & back & 2203 \\  & Warezclient & 1020 & Other attack & 1422 \\  & Teardrop & 979 & warezclient & 1020 \\  & Pod & 264 & & \\ KDD-cup 99 & Guess\_passwd & 53 & & \\  & Buffer\_overflow & 30 & & \\  & Land & 21 & & \\  & Warezmaster & 20 & & \\  & inap & 12 & & \\  & Rootkit & 10 & & \\  & Loadmodule & 9 & & \\  & fp\_write & 8 & & \\  & Multihop & 7 & & \\  & Phf & 4 & & \\  & Perl & 3 & & \\  & spy & 2 & & \\ \hline  & UDP & 3,170,060 & UPD & 3,170,060 \\  & TCP & 2,549,206 & TCP & 2,549,206 \\  & Service\_Scan & 117,170 & Service\_Scan & 117,170 \\  & OS\_Fingerprint & 28,479 & OS\_Fingerprint & 28,479 \\  & HTTP & 3902 & HTTP & 3902 \\  & Normal & 707 & Normal & 707 \\  & Keylogging & 100 & Other Attack & 111 \\  & Data\_Exfiltration & 11 & & \\ \hline \hline \end{tabular}
\end{table}
Table 1: Selected features for each dataset based on the PCA method.