## 3 Proposed Methodology
### Feature Transformation Process  
A unique **Feature Recalibration Process (FRP)** was used to refine features and optimise their contribution to the multi-label DDoS attack detection model after feature generation. Federated learning was enabled by dividing each dataset into five parts for quicker training and scalability. These subsets were shared among clients for parallel training and data privacy. This federated technique speeds up model convergence and computing, especially for massive datasets. DRA and LIS are used in the FRP. The approaches aim to improve the relevance and effect of each characteristic by altering their scales and significance, guaranteeing proper weighting in the model [35].  
Subset Creation for Federated Learning: Each dataset was divided into five subgroups for quicker training. The division distributes data among clients in federated learning for parallel processing and faster training. The dataset \(\mathcal{X}\) is separated into \(n=5\) subgroups, each represented as:  
\[\mathcal{X}_{i}=\frac{1}{5}\mathcal{X},\quad i=1,2,3,4,5 \tag{13}\]  
To maintain diversity and balance between clients, each subset, \(\mathcal{X}_{i}\), comprises a representative distribution of the original dataset.  
Dynamic Range Adjustment (DRA): The FRP begins with DRA, which normalises features to a consistent range to solve unequal scaling across features. To calculate recalibration for a feature, \(\rho_{m}\), use Equation (14):  
\[\hat{\rho}_{m}=\frac{\rho_{m}-\min(\rho_{m})}{\max(\rho_{m})-\min(\rho_{m})} \cdot(E-F)+F \tag{14}\]  
In this equation, \(\rho_{m}\) represents the original feature values, \(\min(\rho_{m})\) and \(\max(\rho_{m})\) represent the lowest and maximum values of feature \(\rho_{m}\), and \(F\) and \(E\) represent the scaling target range (e.g., \(F=0\)). This transformation standardises feature values within the required range, making them similar across scales.  
Local Impact Scaling (LIS): The second strategy emphasises traits highly connected with target labels. To determine the scaling factor for each feature \(\sigma_{n}\), consider its local contribution to the target variable \(\tau_{p}\). Equation (15) defines the effect scaling factor, \(\kappa_{n,p}\):  
\[\kappa_{n,p}=\frac{\text{Cov}(\sigma_{n},\tau_{p})}{\text{Var}(\sigma_{n})+ \zeta} \tag{15}\]  
The covariance between feature \(\sigma_{n}\) and target label \(\tau_{p}\) is represented by \(\text{Cov}(\sigma_{n},\tau_{p})\), the variance of feature \(\sigma_{n}\) is represented by \(\text{Var}(\sigma_{n})\), and \(\zeta\) is a. Higher impact variables are scaled up, giving them more significant model influence, whereas lower impact factors are scaled down.  
Finally, the final set of recalibrated features, \(\mathcal{F}_{r}\), is created by successively applying dynamic range adjustment and local impact scaling to all features. The whole recalibrated feature set, \(\mathcal{F}_{\text{final}}\), is:  
\[\mathcal{F}_{\text{final}}=\left\{\hat{\rho}_{m},\kappa_{n,p}:\forall\rho_{m },\sigma_{n}\right\} \tag{16}\]  
This procedure optimises recalibrated features for machine-learning models, improving multi-label DDoS attack detection. The FRP maximises feature information and model performance by modifying and scaling feature ranges by local effect. The dataset is divided into subsets for federated learning, which speeds up training and model updates without sacrificing data privacy.