# Intelligent Cyber Attack Detection and Classification for Network-Based Intrusion Detection Systems
## 3 Materials and Methods
### Anomaly Detection  
In our research, anomaly detection is addressed from two distinct viewpoints. The first viewpoint consists of finding patterns in single-flow features, while the second attempts to make a more informed analysis by considering an entire sequence of flows. For the single-flow viewpoint, each enumerated technique was trained with the preprocessed data of the CIDDS-001 dataset. RF and MLP expected a 2D matrix as input, while LSTM, which was specifically designed for sequential data, requires a 3D input. Figure 5 exemplifies how the two dimensional CIDDS-001 preprocessed data and its corresponding 3D transformation can be visualized. The multi-flow approach addresses the problem from a different point of view. Patterns acquired from single-flow features can be insufficient to correctly detect and differentiate anomalies. From a temporal and sequential analysis of a given window of flows, it is possible to combine individual patterns with short- to long-term relations between flows, which can potentially lead to better results. In order to conduct this analysis, data had to be reorganized and prepared to reflect the intended temporal properties. The original 2D data were reshaped to a 3D format by performing an one-to-one window overlap. For a selected window size \(s\), a dataset entry \(e_{i}\) can be defined as \(e_{i}=x_{t-s},...,x_{t-1},x_{t}\), where \(x\) is a given flow at a given timestep \(t\). Algorithm 1 describes how the introduced transformation was implemented. \begin{table}
\begin{tabular}{c c} \hline \hline
**Parameter** & **Value** \\ \hline Epoch & 50 \\ Batch Size & 1024 \\ Optimizer & Adam \\ Learning Rate & 0.001 \\ Objective Loss & Categorical Cross-Entropy \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Summary of LSTM configuration. Figure 5: Single flow input visualization. The \(x\) axis stands for the number of features of each flow, the \(y\) represents the number of samples and the \(z\), required for the LSTM input, corresponds to the number of timesteps (1 timestep for single flow). Suppose a given entry, \(e_{i}\), contains \(s+1\) flows. In that case, the first s rows of the algorithm's output matrix should be disregarded because they have invalid data due to the insufficient number of previous timesteps. For this study, the first 99 rows were removed to ensure that the algorithms are trained and tested with the same data, regardless of the selected window size (which is never higher than this value). As previously explained, LSTM is a model designed to deal with three-dimensional data and already expects a 3D matrix as input, while RF and MLP require the conventional 2D input. To provide such an input, the sequential data were flattened into a two-dimensional space. This operation implies no distinction between the features of independent flows and that data, although containing information from previous timesteps, cannot be interpreted as a sequence. This process is represented in Figure 6.  
Figure 6: Multi-flow as a two-dimensional space. The \(x\) axis stands for the number of features, \(y\) represents the number of samples and \(z\) describes the number of time steps. In conclusion, in our approach the network traffic data are first preprocessed, removing the least meaningful features, then the flows are ordered in chronological order and the resultant feature vector is transformed into a numerical representative form, as explained in Section 3.2 Then, the preprocessed data are transformed to a three-dimensional format according to a given window size and split into train, validation and test sets. For the RF and MLP models, the 3D data are reshaped into a corresponding 2D format, and for the LSTM, the data are directly used in their 3D representation. Finally, each model produces predictions, which are evaluated by the metrics described in Section 3.5. Regarding the hold-out method, 70% of the total data were selected for training, while the remaining 30% were used for testing. From the training set, 10% of data were set aside for validation.