# Big Data-Driven Deep Learning Ensembler for DDoS Attack Detection
## 4 Simulation and Results
### Dataset Preparation and Preprocessing  
In order to guarantee the quality and dependability of the datasets, IoT-23 and APA-DDoS were preprocessed extensively. In order to avoid bias, we used imputation methods to fill in missing data and detected and removed outliers. Model performance and convergence were both enhanced by standardizing and normalizing the data to guarantee consistency across features. In order to assess the connections between features, we used correlation analysis.  
Figure 4 shows the correlation matrix of chosen IoT-23 properties, showing noteworthy correlations. Longer connection lengths are related to more significant packet countsand missing bytes, as indicated by the positive association between connecting time and original packet count, response IP bytes, and response packet count. The characteristic orig_ip_bytes is positively connected with orig_bytes and orig_pkts, demonstrating that the number of packets and bytes in the connection is closely related to the initial IP bytes. As mutually exclusive protocols, proto_tcp and proto_udp have a high negative association. Additionally, proto_icmp has a negative correlation with conn_state_S0 and a positive correlation with conn_state_OTH, showing ICMP protocol connection state patterns. Several response metrics positively correlate with the number of original packets (orig_pkts), including response IP bytes (resp_ip_bytes), response packets, and missing bytes. Rep_bytes is closely connected with resp_ip_bytes and missing bytes, implying that more significant response byte counts lead to more missed bytes. Significant relationships exist between connection statuses. Conn_state_S0 and conn_state_OTH are strongly negatively correlated, showing different connection characteristics. Further, conn_state_SF is positively correlated with resp_bytes and negatively correlated with conn_state_S0, indicating successful connection completions. Finally, missed_bytes correlates with resp_bytes, resp_ip_bytes, and resp_pkts, demonstrating that connections with more response data have more missing bytes.  
The correlation matrix in Figure 5 shows APA-DDoS dataset feature associations. The direction and strength of the linear relationship between two attributes in each matrix cell are indicated by the association factor, which may take values between \(-1\) and \(1\). A coefficient of \(1\) indicates an entirely positive linear relationship, \(-1\) is a wholly negative one, and \(0\) is the absence of any linear association.  
Figure 4: Data correlation of IoT-23 dataset.  
As predicted, diagonal elements show perfect correlations of 1, reflecting each feature's association with itself. Beyond the diagonal, interesting patterns arise. Notably, \"tcp.srcport\", \"Tx Bytes\", \"Bytes\", \"Rx Bytes\", and \"Tx Packets\" have high positive relationships. It seems that changes in one attribute are proportionate to changes in the others. Additionally, \"tcp.flags.push\" and \"frame.len\" have moderate positive correlations with specific attributes, suggesting linkage. However, 'Packets' and 'Rx Packets' have lesser relationships. These findings are crucial for feature selection since strong correlations imply repetition, while low correlations indicate independence or unique information. Optimizing predictive model performance and exploiting dataset information requires understanding these inter-feature interactions.