## 2 Materials and Methods
### Data Preprocessing
A new binary variable is created for each feature, wherein the binary bit associated with the feature is set to 1, while the remaining binary bits are set  
\begin{table}
\begin{tabular}{c c c} \hline \hline  & **Feature One-hot encoding: The purpose of feature one-hot encoding is to transform non-numeric categorical features into a numerical representation that can be processed by computer-based algorithms [27]. Machine learning algorithms rely on mathematical models and statistical methods, which typically operate on numeric data. However, categorical features consist of discrete symbols or labels that lack direct numerical significance. To address this, we employ one-hot encoding to expand the discrete feature values into a Euclidean space, thereby enabling the encoding of data features. Each possible feature value corresponds to a new binary variable in this process. A new binary variable is created for each feature, wherein the binary bit associated with the feature is set to 1, while the remaining binary bits are set  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Dataset** & **Feature Column** & **Meaning** \\ \hline \multirow{6}{*}{NSK-KDD} & num\_outbound\_cmds & The feature has zero values in the dataset and provides no information for the classification task \\ \cline{2-3}  & is\_host\_login & Indicates whether the host login is successful or not, no contribution to the classification task \\ \cline{2-3}  & land & This feature indicates whether the source IP address and the destination IP address are the same, and this feature has no effect on the classification task \\ \hline \multirow{6}{*}{UNSW-NB15} & Scrip & These features represent the source and target IP addresses, and for the classification task of intrusion detection, the IP addresses alone have no direct impact \\ \cline{2-3}  & Source IP & These features represent source and target IP addresses and have no impact on the classification task of intrusion detection \\ \cline{1-1} \cline{2-3}  & Scrip & These features represent the source and target IP addresses, and for the classification task of intrusion detection, the IP addresses alone have no direct impact \\ \hline \multirow{6}{*}{CICIDS2017} & Source IP & These features represent source and target IP addresses and \\ \cline{1-1 to 0. Consequently, the transformation of categorical features into numeric values is accomplished. 3. Data normalization: This technique converts the entire range of values of a set of features into a predetermined range. Often, the range of data values can vary greatly between features, which can cause the training process of machine learning algorithms to suffer [28]. For example, one feature may have a range of values of [0, 1000], while another may only have a range of [0, 1]. In this case, without normalization, the feature with the larger range of values will take on more weight in the training of the algorithm, so min-max normalization is introduced to map all the data to the interval [0, 1], thus speeding up the convergence of the model and improving the accuracy of the classification results, as follows: \[X^{\prime}=\frac{X-Min}{Max-Min}\] (1) where Min is the minimum value of the feature, Max is the maximum value of the feature and \(X^{\prime}\) is the normalized feature value. The pre-processing steps mentioned above, including data cleansing, one-hot encoding, and data normalization, were applied separately to the three datasets used in this paper: NSL-KDD, UNSW-NB15, and CICIDS-2017. Each dataset underwent these pre-processing steps to ensure consistency and improve the data quality before further analysis and model training. * Numerical processing of NSL-KDD datasets  
The features in columns 2, 3, and 4 of the NSL-KDD dataset (corresponding to \"protocol_type\", \"service,\" and \"flag\", respectively) underwent unique encoding in this study. Specifically, the \"protocol_type\" feature was mapped as a 3-dimensional feature, the \"service\" feature was mapped as a 70-dimensional feature, and the \"flag\" feature was encoded accordingly.