# A Novel Deep Learning Framework for Intrusion Detection Systems in Wireless Network
## 2 Materials and Methods
### Data Preprocessing and Dealing with Imbalanced Problem  
As we mentioned in the Introduction, we applied the AWID3 dataset to train and evaluate our DL framework. This dataset is an 802.11 ac [41] security dataset recorded using the Wireshark version 3.2.7 tool by researchers at the University of the Aegean. The dataset includes 13 types of attacks that commonly occur in wireless networks. To simplify the data pre-processing, we choose to focus on four types of attacks: Spoofing, Evil Twin, Botnet, and Malware. Each data packet contained 254 features. The first step is pre-processing the dataset; the high number of features can cause a rise in computational cost and increase the risk of overfitting while training on the neural network model. We proceeded to use the extra trees classifier, a decision-tree-based method [63], to select only the most significant and recurrent features in the data. Figure 1 indicates the proportion of the ten most common features in the data. The brief descriptions of each feature are provided in the Table 1.  
The features contained both numerical and non-numerical value types. We used one-hot encoding to encode the \"labels\" variable and label encoding to encode the \"wan.ra\" variable. The numerical categories also varied along with a range of values, which could have caused a vanishing gradient and led to underfitting in ML and DL. We, therefore, applied a min-max scaler to the numerical features in the range 0-1 to assist in converging the features' gradients equally. To demonstrate the imbalance problem, the proportions of each data category in our training set are shown in Figure 2.  
The chart in Figure 2 indicates that the proportion of normal traffic in the training data overwhelmed the other categories. Botnet and Evil Twin contained the least data samples with only a few thousand instances, which would have led to a heavily imbalanced data problem during training. However, it is noticeable that normal traffic, not anomalous \begin{table}
\begin{tabular}{c c c} \hline \hline
**Features** & **Type** & **Description.** \\ \hline wlan.ra & string & Receiver address \\ \hline wlan\_radio.signal\_dbm & numerical & Signal strength (dBm) \\ \hline wlan\_radio.duration & numerical & Duration \\ \hline frame.time\_relative & numerical & Time since reference or first frame \\ \hline radiotap.timestamp.ts & numerical & Timestamp information \\ \hline frame.time\_epoch & numerical & Epoch time \\ \hline wlan.fc.protected & numerical & Protected flag \\ \hline frame.len & numerical & Length of frames \\ \hline wlan\_radio.data\_rate & numerical & Data rate \\ \hline frame.number & numerical & Number of received frames \\ \hline labels & string & Packet behavior type (categories) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Descriptions of significant features in the dataset. Figure 1: Significant features in the dataset. traffic, is indeed the most frequently encountered type of traffic in practical contexts. This unavoidable problem reduced the precision and recall of the traffic in categories that represented a smaller proportion of the dataset. Previous studies reduced the number of data categories to a maximum of two or three or avoided the inclusion of normal traffic to overcome this problem. In other cases, the entire dataset was kept and a variety of preprocessing techniques such as Under Sampling, Rank Based Support, Oversampling, and Synthetic Minority Oversampling (SMOTE) were applied in [59; 60; 61]. Despite the methods applied, the problem could still not be completely eliminated and remained a significant challenge in predicting the categories that have smaller data proportions. A lack of sufficient data is a critical issue that as yet remains unsolved, and currently, the only and most effective solution is perhaps to collect more data.