# A Robust Machine Learning Model for Detecting XSS Attacks on IoT over 5G Networks
## 3 Proposed Methodology
### Preprocessing  
Preprocessing, which involves careful cleaning to remove errors and unnecessary information, is crucial for transforming raw data into a format that is suitable for analysis [30]. The NF-ToN-IoT-v2 dataset, which contains 53,464 records and 44 attributes, is preprocessed in our work by handling anomalies via value replacement and filling in missing values by imputing the maximum attribute values. In order to facilitate machine learning, nominal data labels are translated to numerical values, and input traffic is categorized as \"Benign (0)\" or \"Attack (1)\" during training. We use the Synthetic Minority Over-sampling Technique (SMOTE) to address class imbalance, ensuring that the model can detect less frequent attack instances effectively. The data preparation process was designed to ensure the machine learning model could be trained effectively and efficiently using MATLAB software 2024. This preprocessing phase involved several key steps:  
* **Data Cleaning:** In this step, we identified and removed all instances of missing (NaN) and infinite values present in the original dataset, which could have been introduced by measurement errors or data corruption. By eliminating these values, the dataset was made more consistent and reliable for subsequent analysis and model training. * **Data Normalization:** Normalization of the input data was performed to enhance the training process and improve the machine learning model's performance. This step is particularly important when features have widely varying numerical ranges. By scaling the data to a common range, such as between 0 and 1, the model could avoid potential classification errors and reduce training time. This normalization process also prevents features with larger numerical magnitudes from disproportionately influencing the learning process [31]. * **Handling Class Imbalance:** In real-world IoT environments, security datasets often exhibit class imbalance, with attack instances occurring less frequently than benign instances. This imbalance can result in a model biased towards the majority (benign) class, leading to reduced detection accuracy for attacks. To address this, we used the Synthetic Minority Over-sampling Technique (SMOTE), which generates synthetic samples of the minority (attack) class by interpolating between existing instances. By creating a more balanced dataset, SMOTE helps the model learn meaningful patterns in attack data and enhances its sensitivity to rare but critical attack events [32]. This approach is especially relevant for IoT security applications, where detecting these rare occurrences is essential for maintaining system integrity. The following (Algorithm 1) outlines the SMOTE process for handling class imbalance in our dataset:
* **Data Labeling and encoding:** After cleaning and normalization, the data was prepared for binary classification. The labeled data was encoded to classify input traffic into \"Benign (0)\" or \"Attack (1)\" classes. All instances of Cross-Site Scripting (XSS) attacks were categorized as \"Attack,\" while normal traffic was labeled as \"Benign.\" This