# AI-Based RPA's Work Automation Operation to Respond to
## 3 Methodology
### Data Collection and Preprocessing  
The data used in this study were meticulously curated from logs generated by the CERT security team of government institutions over the past decade. This dataset, sampled for research purposes, focuses specifically on firewall systems, intrusion detection systems, and unauthorized access-blocking systems. To ensure a high-quality training process for the model, a total of 30,000 well-structured cybersecurity threat logs were utilized, providing a solid foundation for AI learning. The data files are available in JSON, XML, and CSV formats, containing critical information such as source IP addresses, destination IP addresses, and attack patterns. The data preprocessing phase involved multiple steps to optimize the dataset for AI training. Initially, unnecessary information and outliers were removed to enhance model accuracy. Given the heterogeneous nature of the data collected from various security solutions, it was essential to standardize and convert these logs into CSV format to ensure efficiency and consistency in data management. The converted CSV files were subsequently transformed into *.db files using SQLite, thereby improving the efficiency of database management and enabling effective storage and accessibility. The advantages of this conversion process are summarized in Table 1.  
Particularly, as illustrated in Figure 4, we developed a system that standardizes and automates the real-time collection and preprocessing of log data from multiple security solutions. This system focuses on enhancing data quality by performing a series of data refinement tasks, such as removing duplicate records, deleting unnecessary columns, and handling missing values. By eliminating redundancy in the dataset, the overall data volume was reduced while maintaining the reliability of the information, thus maximizing the efficiency of the model training process. Handling missing values was also crucial to ensuring the completeness of the data, thereby minimizing inaccuracies during the learning phase. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Category** & **Database** & **CSV File** \\ \hline Data Integrity and Consistency & Constraints (primary keys, foreign keys, etc.) can be set & Constraints cannot be applied \\ \hline Efficient Data Search & Fast search through indexing is possible & Requires reading the entire file, which is slow for large datasets \\ \hline Data Consistency & Atomicity is guaranteed through transaction management & Conflicts may occur during concurrent modifications \\ \hline Representation of Data Relationships & Various relationships between tables can be defined & Difficult to manage when data structure becomes complex \\ \hline Handling Large Data Sets & Efficient processing of large datasets is possible & Performance degrades as file size increases \\ \hline Data Transformation and Analysis & Easily transformed and analyzed through SQL & Additional processing required \\ \hline Security and Access Control & User-specific access permissions can be set & Weak security management \\ \hline AI Training Data Preparation & Batch processing and automation are possible & Automation is difficult as the file must be read each time \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of database and CSV file characteristics. The system is designed to collect log data in real-time from different security solutions, ensuring that the latest threat information is always available for analysis. This real-time data collection process is critical for the timely detection and response to cybersecurity threats, allowing the system to immediately capture and process emerging threats. As shown in Figure 5 the data preprocessing also involved encoding key features to prepare the data for effective AI training. For example, the source and destination IP addresses, as well as attack patterns, were transformed into numerical representations using LabelEncoder.