## 4 Proposed Machine Learning Technique for Detection System
### EBA and SBA Based Data Preprocessing  
For the purpose of signaling DDoS attack detection, we defined new features based on the EBA and the SBA, performed data preprocessing, created data having new features as shown in Table 3 by utilizing EBA and SBA, and completed feature selection using a variety of statistical-based test methods. ### EBA and SBA Based Data Preprocessing  
For the purpose of signaling DDoS attack detection, we defined new features based on the EBA and the SBA, performed data preprocessing, created data having new features as shown in Table 3 by utilizing EBA and SBA, and completed feature selection using a variety of statistical-based test methods. 1. Statistical-based Features First of all, we performed preprocessing utilizing the SBA with respect to time value and the number of users. 1. As depicted in Figure 6, we performed preprocessing as given below, for the total time value (_t_total_time_). The interval in time between the first traffic and the last travel of one user (identified by IMSI) for a duration of 1 min of unit time (S is a bearer or session create time): \[t\_total\_time=S_{n}-S_{n-1}\] (1) \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**No.** & **Category** & **Feature** & **Description** & **Example** \\ \hline
6 & User & IMSI & IMSI Number & 450051001000010 \\ \hline
16 & & SmfIP & SMF IP & 1677853029 \\ \hline
18 & & AmfIp & AMF IP & 1677852929 \\ \hline
20 & & UpfIP & UPF IP & 1677853129 \\ \hline
22 & & gNBIP & gNB IP & 1677852939 \\ \hline
41 & Bearer & BearerCreatedTime & Bearer Start & 1630652548.64154 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Collection fields utilizable for signaling DDoS attack detection. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Attribute** & **Feature** & \multicolumn{2}{c}{**Description**} \\ \hline \hline \multirow{6}{*}{Statistics} & Total time value & _t\_total\_time_ & Total elapsed time of traffic in a unit of time (t) \\ \cline{2-3}  & Mean time value & _t\_mean\_time_ & Mean value of interval of traffic create time in a unit of time (t) \\ \cline{2-3}  & Variance time value & _t\_var\_time_ & Variance value of interval of traffic create time in a unit of time (t) \\ \cline{2-3}  & Standard deviation time value & _t\_std\_time_ & Standard deviation of interval of traffic create time in a unit of time (t) \\ \cline{2-3}  & Single IMSI count & _t\_simi\_count_ & Traffic count of one IMSI subscriber in a unit time (t) \\ \cline{2-3}  & All IMSI count & _total\_count_ & Traffic count of all IMSI subscribers in unit of time (t) \\ \hline Entropy of one IMSI subscriber & _imsi\_entropy_ & Entropy of one IMSI subscriber in unit of time (t) \\ \cline{2-3}  & Smf entropy of one IMSI subscriber & _imsi\_smf\_entropy_ & SmfIP entropy of one IMSI subscriber in unit of time (t) \\ \cline{2-3}  & Amf entropy of one IMSI subscriber & _imsi\_smf\_entropy_ & AmfIP entropy of one IMSI subscriber in unit of time (t) \\ \cline{2-3}  & upf entropy of one IMSI subscriber & _imsi\_upf\_entropy_ & UpfIP entropy of one IMSI subscriber in unit of time (t) \\ \cline{2-3} Entropy & gnb entropy of one IMSI subscriber & _imsi\_gnb\_entropy_ & gNBIP entropy of one IMSI subscriber in unit of time (t) \\ \cline{2-3}  & Smf entropy of all IMSI subscribers & _smf\_entropy_ & SmfIP entropy of all IMSI subscribers in unit of time (t) \\ \cline{2-3}  & Amf entropy of all IMSI subscribers & _amf\_entropy_ & AmfIP entropy of all IMSI subscribers in unit of time (t) \\ \cline{2-3}  & upf entropy of all IMSI subscribers & _upf\_entropy_ & UpfIP entropy of all IMSI subscribers in unit of time (t) \\ \cline{2-3}  & gnb entropy of all IMSI subscribers in unit of time (t) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Features involved in preprocessed data. In this case, the value of total time is (a) 0 if the number of the traffic for 1 min as unit of measure is less than 2, or (b) 60 or less if the number of traffic for the same duration is 2 or greater.