## 2 Materials and Methods
### Data Preprocessing
These encoded features were appended to the original data. As a result, the dimensionality of the original data increased from 41 to 118 after numerical processing, considering the removal of num_outbound_cmds, is_host_login, and land features, as they were irrelevant to determining abnormal data. This resulted in a total of 115 dimensions for the processed dataset. Table 2 illustrates the outcome of the numerical processing of the dataset. * UNSW_NB15 Numerical processing of data sets  
The UNSW_NB15 dataset underwent unique coding for the features in columns 3, 4, and 5 (corresponding to \"proto\", \"service\", and \"state\", respectively). In this study, these three columns of features were uniquely encoded. The \"protocol type\" feature was mapped as a 3-dimensional feature, the \"proto\" feature was mapped as a 131-dimensional feature, the \"service\" feature was mapped as a 12-dimensional feature, and the \"state\" feature was mapped as a 12-dimensional feature. The \"srcip\" and \"dstip\" columns in the feature dataset represent IP addresses, but since the judgment of data abnormality does not \begin{table}
\begin{tabular}{c c c c c c c c c} \hline  & **0** & **1** & **2** & \(\dots\) & **113** & **114** & **115** & **Label** \\ \hline
0 & \(3.47\times 10^{-5}\) & \(2.07\times 10^{-4}\) & 0 & \(\dots\) & 0 & 1 & 0 & normal \\ \hline
1 & 0 & \(3.18\times 10^{-7}\) & 0 & \(\dots\) & 0 & 1 & 0 & saint \\ \hline
2 & \(1.73\times 10^{-5}\) & 0 & \(1.11\times 10^{-5}\) & \(\dots\) & 0 & 0 & 0 & mscan \\ \hline \(\dots\) & \(\dots\) & \(\dots\) & \(\dots\) & \(\dots\) & \(\dots\) & \(\dots\) & \(\dots\) & \(\dots\) \\ \hline
125,968 & 0 & \(8.12\times 10^{-7}\) & \(6.22\times 10^{-3}\) & \(\dots\) & 0 & 1 & 0 & phf \\ \hline
125,969 & \(3.47\times 10^{-5}\) & \(6.33\times 10^{-6}\) & \(2.88\times 10^{-3}\) & \(\dots\) & 0 & 1 & 0 & sqlattack \\ \hline \end{tabular}
\end{table} 
Table 2: NSL-KDD after data processing. depend on IP addresses, they were not included in the coding process. Table 3 illustrates the outcome of the numerical processing of the dataset. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline  & **0** & **1** & **2** & \(\ldots\) & **72** & **73** & **74** & **Label** \\ \hline
0 & \(1.22\times 10^{-3}\) & \(6.93\times 10^{-1}\) & \(3.33\times 10^{-5}\) & \(\ldots\) & 0 & \(6.92\times 10^{-1}\) & \(6.92\times 10^{-2}\) & DoS Hulk \\ \hline
1 & \(8.08\times 10^{-4}\) & \(5.08\times 10^{-4}\) & 0 & \(\ldots\) & 0 & 0 & 0 & BENIGN \\ \hline
2 & \(6.97\times 10^{-1}\) & \(2.13\times 10^{-6}\) & \(4.76\times 10^{-6}\) & \(\ldots\) & 0 & 0 & 0 & BENIGN \\ \hline \(\ldots\) & \(\ldots\) & \(\ldots\) & \(\ldots\) & \(\ldots\) & \(\ldots\) & \(\ldots\) & \(\ldots\) & \(\ldots\) \\ \hline
1,977,047 & \(9.16\times 10^{-2}\) & \(3.83\times 10^{-7}\) & 0 & \(\ldots\) & 0 & 0 & 0 & PortScan \\ \hline
1,977,048 & \(1.22\times 10^{-3}\) & \(1.51\times 10^{-4}\) & \(4.76\times 10^{-6}\) & \(\ldots\) & 0 & 0 & 0 & DoS Hulk \\ \hline \end{tabular}
\end{table} 
Table 4: CICIDS2017 after data processing. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline  & **0** & **1** & **2** & \(\ldots\) & **185** & **186** & **187** & **Label** \\ \hline
0 & \(1.67\times 10^{-7}\) & \(9.39\times 10^{-5}\) & 0 & \(\ldots\) & \(1.69\times 10^{-2}\) & \(3.27\times 10^{-2}\) & 0 & Normal \\ \hline
1 & \(5.00\times 10^{-8}\) & \(9.39\times 10^{-5}\) & 0 & \(\ldots\) & \(1.69\times 10^{-2}\) & \(1.63\times 10^{-2}\) & 0 & Normal \\ \hline
2 & \(4.85\times 10^{-3}\) & \(8.45\times 10^{-4}\) & \(7.26\times 10^{-4}\) & \(\ldots\) & \(2.54\times 10^{-1}\) & 0 & 0 & DoS \\ \hline \(\ldots\) & \(\ldots\) & \(\ldots\) & \(\ldots\) & \(\ldots\) & \(\ldots\) & \(\ldots\) & \(\ldots\) & \(\ldots\) \\ \hline
175,337 & 0 & \(1.84\times 10^{-2}\) & \(1.78\times 10^{-3}\) & \(\ldots\) & \(3.38\times 10^{-2}\) & \(1.63\times 10^{-2}\) & 0 & Normal \\ \hline
175,338 & \(3.47\times 10^{-5}\) & \(2.39\times 10^{-2}\) & \(8.45\times 10^{-4}\) & \(\ldots\) & 0 & 0 & 0 & Normal \\ \hline \end{tabular}
\end{table}