## 3 Research Methodology
### Dataset Generation
#### 3.1.2 Network Testbed for Dataset Generation  
This study successfully established the network scenario, and the script necessitates the simulation of a transmission from one network to another. As depicted in Figure 2, it can be observed that upon entering the transmission session, the initial action taken with the packet is to subject it to a store-and-forward operation. After the completion of the \"error checking\" process on the store-and-forward mechanism, the packet will undergo an examination of its header information. Given that the label column of CIC-IDS 2017 dataset entries denotes distinct categories of attacks., the purpose of this study is to investigate the specific alterations made to  
Figure 2: A schematics of the network scenario that involves the store-and-forward operation. the header field in cases where the flow is linked to a certain activity. The analysis of traffic distribution which involves identification of any disparities in the allocation of traffic among servers or services can reveal a DDOS attack. Such disparities may serve as indicators of potential efforts to overload particular resources. Furthermore, since another primary indicator of a DoS attack is \"Traffic Volume\", this metric can be analyzed in terms of an abnormally elevated influx of incoming network traffic directed towards a particular target or segment of a network. Thus, \"Flow Duration\" and \"Forward Packets/s,\" can be utilized for the purpose of recording this information. These two features are sufficient to demonstrate the prevalence of DDoS attacks. The features are also present in the CIC-IDS 2017 dataset. Hence, this study aimed to capture and conceptualize these features within a store-and-forward network. To facilitate the analysis of the packet during the transmission session and generate the dataset, the following steps were performed:  
* Scripts that will incorporate a modified value into specific packet header information within designated scenarios were developed. * An additional script that preserves the default value assigned by the IP protocol in certain packets within the given scenarios was developed. * An additional script that facilitates the transmission of IP packets recording the default values \"Flow Duration\" and \"forward packets\" within the given scenarios, as well as those that incorporate the modified values of the selected IP packet headers within the scenarios, was developed. * The \"Flow Duration\" and \"forward packets\" field information is defined as the set of data elements that can be modified in a given scenario. We composed a dummy value situation wherein a specific value within the \"store-and-forward process\" was modified. * We created a script for conducting a comprehensive examination to ascertain the existence of all packet headers. * An additional script will generate a comprehensive report containing all the information present in the \"Flow Duration\" and \"forward packets\" at the specific moment of transmission. * Subsequently, a script will be developed to construct a binary function that will determine whether the entirety of the IP packet's \"Flow Duration\"and \"forward packets\" has been altered or not, represented in a binary set format. * Another script will be executed iteratively to generate datasets. The given scenario involves a network router that utilizes the \"store-and-forward process\" for its operation. The router is responsible for receiving IP packets and temporarily storing them prior to their subsequent transmission to their intended destinations. During the \"store\" phase, the router is able to conduct a thorough examination and verification of all alterations made to the packet header. In order to comprehensively analyze the situation, it is imperative to delineate the scenario in a sequential manner. Upon the arrival of an IP packet at the router, it is temporarily stored in the router's memory as part of the \"store-and-forward process\".