## 3 Materials and Methods
### Feature Selection for Malicious Traffic Classification
It is computed as follows: \[\mu=\frac{1}{n}\sum_{i=1}^{n}X_{i}\] (1) where \(\upmu\) is the mean, Xi presents the feature's value for the \(i\)-th instance, and n is the total number of instances. * The second central moment, referred to as variance (\(\upsigma^{2}\)), quantifies the extent to which each data point in the feature deviates from the mean, revealing the dispersion or variability in the feature values. Analysis of variance (ANOVA) is a widely utilized technique for data mining in various scientific and engineering disciplines [31]. However, in this study, we employed standard deviation, the square root of the variance, as it provides a more interpretable measure of dispersion [32]. The standard deviation (\(\upsigma\)) is computed as follows: \[\sigma=\sqrt{\frac{1}{n}\sum_{i=1}^{n}(X_{i}-\mu)^{2}}\] (2)
* The third central moment, skewness (\(\gamma_{1}\)), quantifies the asymmetry of a distribution. A skewness coefficient of zero signifies a perfectly symmetrical distribution. A positive skewness indicates that the distribution has a longer tail on the right side (right-skewed), whereas a negative skewness suggests a longer tail on the left side (left-skewed) [33; 34]. However, skewness and kurtosis are interpreted differently across various studies and statistical software. As a result, different definitions and formulas can affect the interpretation of these measures. Therefore, our study uses the definitions and formulas provided by Python's scientific statistics (SciPy. stats) module to ensure clarity. Precisely, skewness is calculated using the Fisher-Pearson coefficient, and kurtosis is measured as excess kurtosis, [PERSON]'s definition of kurtosis [33]. Hence, skewness is computed as follows: \[\gamma_{1}=\frac{1}{n}\sum_{i=1}^{n}\frac{(X_{i}-\mu)^{3}}{\sigma^{3}}\] (3)
* The fourth central moment, kurtosis (\(\gamma_{2}\)), quantifies the \"tailedness\" of the distribution of the feature values. It indicates whether the data distribution has heavier tails (positive kurtosis) or lighter tails (negative kurtosis) compared to a normal distribution [35]. Kurtosis is computed as follows:  
\[\gamma_{2}=\frac{1}{n}\sum_{i=1}^{n}\frac{(X_{i}-\mu)^{4}}{\sigma^{4}}-3 \tag{4}\]  
As previously highlighted, if excess kurtosis ([PERSON]'s definition) [33] is utilized, the subtraction of 3 adjusts the kurtosis of a normal distribution to zero. Once the statistical moments are computed, we proceed to calculate the absolute differences between the characteristics of the legitimate and the attack classes. This step involves determining the degree of deviation in the mean, standard deviation, skewness, and kurtosis of each feature between the two classes. For instance, the absolute difference in the mean is given by Equation (5), and similar formulas are applied for standard deviation, skewness, and kurtosis, respectively. \[\Delta_{u_{i}}=|\mu_{i,\text{legitimate}}-u_{i,\text{attack}}| \tag{5}\]  
The absolute differences for each statistical moment are then summed for each feature to obtain a composite score representing the overall difference. A threshold value is then applied to the summed differences to identify the most significant features. Features with summed differences exceeding this threshold are considered and selected for model training. We iteratively adjust the threshold value to find the optimal threshold that leads to the best informative features. Using this approach, we reduced the number of features to 5. Algorithm 1 details the FS algorithm applied in this study, and Table 3 summarizes the retained features used for model training.