## 3 Methodology
### Datasets
#### 3.1.2 NSL-KDD Dataset  
The NSL-KDD dataset is a refined version of KDD-99, which was developed as part of the International Knowledge Discovery and Data Mining Tools Competition. NSL-KDD consists of 125,973 instances and includes the raw data from KDD Cup 1999, with some redundant data removed [23]. This dataset was constructed in 1999 for a competition aimed at building a predictive model capable of distinguishing between \"good\" and \"bad\" network connections. It comprises 41 features, including 38 continuous and 3 categorical variables. The dataset consists of one normal label and approximately 22 different types of attacks, including neptune, satan, ipsweep, portsweep, smurf, nmap, back, teardrop, warezclient, pod, guess_passwd, buffer_overflow, warezmaster, land, map, rootkit, loadmodule, ftp_write, multihop, phf, perl, and spy. The normal activity class has the highest frequency with 67,343 samples, while \"neptune\" is the most frequent attack with 41,214 samples, and \"spy\" represents the least frequent attack with only two instances. Please note that the information provided here is a general description of the attack types. For a more comprehensive understanding, it is recommended to refer to the specific literature or research papers that discuss these attack types in detail [24]. \"Neptune\" is a type of denial-of-service (DoS) attack aimed at overwhelming the target system with excessive traffic to render it unresponsive. \"Satan\" is a probing attack where the target system is actively scanned to identify vulnerabilities. The \"ipsweep\" involves scanning a range of IP addresses to locate live hosts on a network, and \"portsweep\" is similar but scans multiple machines to find vulnerable services. \"Smurf\" involves flooding the network with Internet Control Message Protocol (ICMP) echo to request packets, leading to a slowdown or denial of service, and \"nmap\" is a widely used network scanning tool. In the context of the dataset, this attack refers to the use of nmap for reconnaissance purposes. \"Back\" involves gaining unauthorized access to a system, typically by exploiting vulnerabilities in the network or application. \"Teardrop\" exploits a vulnerability in the reassembly of fragmented IP packets, causing the target system to crash or become unstable. \"Warezclient\" is associated with clients attempting to download or share copyrighted software or data without proper authorization. \"Pod\" (ping of death) attack involves sending oversized or malformed packets to the target system, causing it to crash or become unresponsive. \"Quess_passwd\" represents attempts to guess user passwords by systematically trying different combinations until a successful login is achieved. \"Buffer_overflow\" exploits a vulnerability in a program's buffer handling, allowing an attacker to overwrite memory and execute malicious code. \"Warezmaster\" is similar to warezclient, refers to the presence of a server that hosts unauthorized or pirated software. \"Land\" attack involves sending a spoofed TCP SYN packet with the source IP address and port set to the same as the target system. This causes the system to respond to itself and potentially crash. \"Imap\" attack targets the Internet Message Access Protocol (IMAP) service, which is used for retrieving email from a remote server. \"Rootkit\" is a collection of tools and techniques used by an attacker to gain unauthorized access and maintain control over a compromised system. \"Loadmodule\" involves loading a malicious code module into the target system's memory, enabling the attacker to execute arbitrary commands. \"ftp_write\" refers to unauthorized write access to an FTP server, allowing an attacker to upload or modify files. \"Multihop\" involves an attacker using multiple compromised systems to carry out an attack, making it difficult to trace the origin. \"Phf\" targets the Common Gateway Interface (CGI) program called PHF, which is used for querying remote servers. \"Perl\" is associated with the execution of malicious Perl scripts on the target system.