## 4 Detection and Mitigation Mechanism
### Idbn
#### 4.1.1 Data Processing  
Appropriate data processing can better describe the laws among the data. Through the study of intrusion detection by related researchers [26], the performance of the data classifier mainly depends on the selected method and the manner of data processing. Figure 2 shows the DBN improvement process based on the NSL-KDD dataset. The NSL-KDD dataset that provided by the Canadian institute for cybersecurity is used as the intrusion detection dataset. In this paper, the 41 dimensional data characteristics are divided into the nominal type and the numeric type (Table 1). The probability mass function (PMF) encoding of the nominal type and the normalization processing of the numeric type are carried out, respectively. The NSL-KDD dataset comes from the information flow of the network. Each piece of the data contains multiple information characteristics, which include the basic numeric type as well as the nominal type. The dataset is formed by the data and data characteristics. It is used for the cloud server to train the classifier and detect abnormal data. In the actual process of intrusion detection, the input of training data by classifiers usually belongs to the numerical type [27]. However, the data of nominal type is crucial to the performance of the classifier. For example, the field protocol type and service type of the network data packet are both nominal types. Therefore, these data need to be converted to numeric types. For a dataset with \(n\) characteristics, it is mapped into \(M\) feature vectors, each of which is denoted as \(x=(x_{1},x_{2},\cdots,x_{n})\). Assuming that \(x_{j}=\big{(}x_{1j},x_{2j},\cdots,x_{Mj}\big{)}(j\in\{1,2,\cdots,n\})\) represents the \(j\)th feature of each piece of data, which belongs to the nominal type. \(x_{j}\) contains \(K\) kinds of nominal values \(nom_{1j},nom_{2j},\cdots,nom_{kj}\). Letting \(r_{kj}\in N\) be the number of occurrences of the value \(nom_{kj}\) in \(x_{j}\), and it can be obtained:  
\[r_{kj}=\big{|}\big{\{}i\in Nx_{ij}=nom_{kj},i=1,2,\cdots,M\big{\}}\big{|},\ k=1,2, \cdots,N \tag{1}\]  
According to Equation (1), the frequency value \(f_{kj}\) of \(nom_{kj}\) appearing in \(x_{j}\) can be expressed as:  
\[f_{kj}=\frac{r_{kj}}{M}, \tag{2}\]  
and  
\[\sum_{k=1}^{k}r_{kj}=M,\ 0\leq r_{kj}/M\leq 1. \tag{3}\]  
For the nominal type data \(x_{kj}\) in the dataset, literature [28; 29] encode it with the digital coding method. The corresponding field is coded as \(0,\ 1,\cdots,\ N\) according to the number of possible values for the field. This process can achieve the conversion of nominal type to numeric type, but it is also  
Figure 2: The improvement process of DBN. necessary to normalize the converted data again. Moreover, in [30; 31], the method of binary encoding is used. Although the converted data are all in \([0,\ 1]\), this method has an obvious disadvantage. That is, it will seriously increase the dimension of the original data, resulting in the demand for multiple layers, which leads to a complex DBN model structure needed to extract effective characteristics of the classification. To solve the above-mentioned problems, this paper converts the nominal type \(x_{kj}\) into the numeric type \(x_{kj}=f_{kj}\) through the calculation method of PMF. The dimension of the converted values has not changed. In addition, it can guarantee that all converted values are all in \([0,1]\), which is equivalent to completing the two operation steps of type conversion and data normalization at the same time. In a dataset, the magnitude of data is often not in the same order [32]. This leads to a decrease in the rate at which the gradient descent to find the optimal solution when learning the data laws. It is also possible that heavy-duty robots cannot complete data processing and detection due to the slow convergence or even inability to converge, which may affect the classification accuracy. Therefore, the data needs to be normalized to \([0,1]\).