## 4 Framework Design
### Phase 2: Transfer Learning  
In phase 2, our framework acquires a training model for intrusion detection against the target domain by utilizing the knowledge transferred from phase 1. For evaluation, the Binary Cross Entropy (BCE) loss function is employed to assess the accuracy of malicious traffic detection for source domains with a high similarity. We selected BCE because it measures the difference between the predictive probability of the model and the actual class and is a suitable loss function for binary classification. During the experiment, the binary classifier is trained by setting malicious traffic to 1 and positive traffic to 0. The BCE loss function is defined as follows:  
\[BCE=-\frac{1}{N}\sum_{i=1}^{N}[t_{i}\log(y_{i})+(1-t_{i})\log(1-y_{i})] \tag{3}\]  
Here, \(t_{i}\) represents the actual label (either 0 or 1), and \(y_{i}\) is the predicted binary probability (\(0<y_{i}<1\)) for the data. As the prediction becomes more accurate, the loss decreases. Our aim is to minimize the total loss through training.  
To prevent overfitting, we introduce five Dense layers and four Dropout layers (see Figure 3). The Dropout layer deactivates random neurons during training to enhance generalization capabilities. To reduce the model's complexity and enhance generalization, a Dropout rate of 0.3 is applied. In the phase 2 experiments, a ratio of 0.3 showed the most optimal results. Additionally, to simplify the model, we reduce the number of units in the deep learning model and utilize DropConnect in the Dense layers. For binary classification, the Leaky ReLU activation function is used in the four Dense layers excluding the last Dense layer, which requires a Sigmoid activation function. This choice effectively controls the model complexity and mitigates overfitting.  
As shown in Algorithm 2, the goal of phase 2 is to acquire a binary classifier (\(K\)) to judge whether the given target domain instance is benign or malicious. Like the typical architecture composition in a binary classification problem, we use LeakyReLU as an activation function for four dense layers and Sigmoid for the last one. Comparing the Accuracy value, the result obtained from this experiment allows us to determine the highest accuracy when using any of the three \(S_{n}\)s as the source domain. As a result, phase 2 demonstrates the correlation of similarity and performance between data sets based on the accuracy of the target-domain-like source domain identified in phase 1.  
```
Input: Source Domain \(S_{n}\) for \(n=1,2,3\), Target Domain \(T\) Output: Trained Model \(K\)
1 Initialization: Load the source domain evaluated for similarity in Experiment 1. Transfer learning:
2 Train using similar source domain data, evaluate performance on target domain.
3 Phase 2 process:
4 while\(n<3\)do
5 Input Train data (\(S^{\prime}_{n}=S_{n}+T\) 70%), Test data \(T\) 30%.
6 Train data \(S_{n}\) through DNN layer with LeakyReLU and Sigmoid.
7 Compile the model with a BCE loss function for binary classification and Adam optimizer.
8 whileepoch\(\leq\) 100 do
9 Check that overfitting does not occur at epochs 20/40/60/80/100.
10 ifvalidation loss\(<1\)then
11 Early stopping for overfitting prevention.
12 Evaluate the performance of \(K\) by Accuracy on Test data set.
13 Update \(K\) if the model corresponding to \(S_{n}\) has the best performance.
14
15 return Trained Model \(K\).
```  
**Algorithm 2**Transfer learning with source and target domains