## 3 Proposed Approach  
In this section, we present our proposed method for enhancing the classification performance of machine learning models in the context of network data analysis, specifically focusing on port scan attacks both inside and outside networks. By integrating graph theory representation with machine learning algorithms, we aim to uncover previously inaccessible insights and patterns, thereby improving the discriminative capabilities of these models. The proposed method comprises the key steps that are summarized in Figure 1.  
Data preprocessing is a crucial step in ensuring that the raw network data are transformed into a suitable format for analysis. This process typically involves handling missing values, outliers, and noise, as well as standardizing the range of the input features. In our approach, we employ various scaling techniques, such as minimal scaling, robust scaling, and standard scaling, to standardize the data and ensure that the machine learning models can effectively analyze and classify the instances. Next, to incorporate graph theory into the analysis of network data, we convert the preprocessed data into graph-based representations. This process involves constructing graphs that capture the underlying structure and relationships within the network data. Nodes in the graph represent individual instances, while edges signify the relationships between them. We explore different graph construction techniques, such as adjacency matrices and distance-based methods, to identify the most suitable representation for the given dataset.  
Once the graph-based representations have been created, we proceed with feature extraction and dimensionality reduction. This step aims to identify and extract the most informative features from the graph representations, while reducing the complexity and computational cost of the subsequent machine learning algorithms. We employ techniques such as principal component analysis (PCA) to transform the high-dimensional graph-based data into a lower-dimensional space, preserving the most critical features and patterns. Following this, with the graph-based representations and extracted features in hand, we  
Figure 1: Overview of the proposed method.  
apply various machine learning models to classify the network data instances as either normal or attack. In our approach, we experiment with logistic regression, support vector machines (SVM), and K-means clustering, assessing their performance in terms of accuracy. By comparing the classification performance of these models before and after applying graph theory representation, we can evaluate the efficacy of our proposed method in improving their discriminative capabilities. There are many advantages to integrating graph theory representation with machine learning algorithms. The network data generated in heterogeneous environments, such as the IIoT environment, are enormous by nature. This kind of environment has the potential for malicious traffic to be hidden within the normal ones and remain undetected, especially if it is minimal, such as one connection. In the proposed graph-based methodology, the network traffic is represented, and as few connections as possible are captured. This connection can be an attack such as stealthy attack, which is known to be a hard attack to be detected and classified. An advantage of the proposed methodology is its improvement of ML, which is able to detect this type of attack and classify it, as is proven by the experiments results. On the other hand, there are some limitations with the proposed approach. For example, data preprocessing is a crucial step in ensuring that the raw network data are transformed into a suitable format for converting the data into graph-based representations, and therefore, any error occurring at this stage negatively affects the representation of the data in the graph. Moreover, zero padding that is performed to help preserve the length of network traffic when building an adjacency matrix negatively can lead to a higher computational cost.