# A Local Feature Engineering Strategy to Improve Network Anomaly Detection +
## 1 Introduction  
The literature offers several definitions of the intrusion event, e.g., [PERSON] [1] defined it as an attempt to bypass or compromise a specific objective, which can be a single machine or an entire network. The literature also indicates the CIA model (also called CIA triad or CIA triangle) as the security model to take into account in terms of goals to achieve [2]. It defines the three main requirements of security, namely _confidentiality_, _integrity_, and _availability_, as summarized in Figure 1. The _confidentiality_ requirement expresses the need that a resource related to a machine/network must be accessed only by authorized users; the _integrity_ requirement is related to the need that a resource can be modified only by authorized users, according to their permissions; and the _availability_ requirement means that a resource must be available to authorized users in the times established for it, without any limitation or interruption. In the context of network security, _Intrusion Detection Systems_ (_IDSs_) [3] represent the main tool, as in their different configurations and modalities they are able to analyze the events that occur in anetwork, with the aim of detecting the illegitimate ones. Nowadays, this activity has become crucial due to the huge number of network services, public and private, which involve critical and important areas, such as health services [4], education [5], financial services [6], and so on. One of the most crucial transversal security problems, that of privacy, was deeply investigated by [PERSON] et al. [7], who provided an overview on the area of privacy-preserving data mining, whereas [PERSON] and [PERSON] [8] provided a comparative analysis of some well-known privacy preservation techniques. However, the massive growth of network security risks is given by the contribution of different factors, such as the increase of wireless network connections [9], the advent of the Internet of Thing (IoT) [10], and the large development of new broadband infrastructures (optical fiber [11], 5G [12], etc.). Therefore, in the context of the network protection, the choice of using IDSs together with other canonical protection systems (e.g., firewalls [13]) mainly depend on the inability of these to operate extensively, without previously defined rules. Given this background, the literature identifies different types of IDSs: although they can operate in different manner, their common objective is the analysis and classification of each network event, distinguishing the normal activities from the intrusion ones. For instance, the literature reports intrusion detection approaches based on machine learning criteria such as gradient boosting [14], adaptive boosting [15], and random forests [16]. Other proposals involve artificial neural networks [17], probabilistic criteria [18], or data transformation/representation [19; 20; 21], similarly to what is done, in terms of scenario and data balance, in closely related domains [22; 23; 24; 25; 26; 27; 28; 29; 30]. It should be noted that, besides sharing the same objectives, they also tackle analogous problems, such as the difficulty of classifying intrusion events that are very similar to normal ones in terms of characteristics or the difficulty to detect novel form of attacks (e.g., zero-days attacks [31]). For these reasons, after having positively evaluated the effectiveness of data transformation in other fields [32; 33; 34], which show it to be able to achieve better characterization of the involved information and a clear reduction of the possible feature patterns, we experimented on this strategy in the IDS domain. In more detail, the proposed LFE strategy operates by introducing a series of new features calculated on the basis of the existing ones, along with a discretization of each feature value, according to a numeric range experimentally defined.