# Reducing the False Negative Rate in Deep Learning Based Network Intrusion Detection Systems
## 4 Materials and Methods
### Data Preparation
#### 4.2.1 Preparation of the NSL-KDD Dataset  
As a starting point in the data preparation of the NSL-KDD dataset, we have two subsets of data already divided by the authors, the KDDTrain+ and the KDDTest+. These subsets have 43 features, while the KDDTrain+ subset has 125,793 records and the KDDTest+ subset 22,544. We processed and verified that both subsets do not contain any missing values. Therefore, we could proceed with doing the rest of the data preparation on the subsets as they are.  
The goal of multiclass classification is to correctly classify records that represent a network attack as the attack category they belong to. Therefore, it is necessary to change the label for every record from the attack type to the class to which that attack type belongs. This step is repeated for both subsets. For the model to learn from this data, we need to transform it into numerical values. For this transformation, we employed one-hot encoding. One-hot encoding is a technique used for categorical features where no ordinal  
Figure 2: An overview of the steps taken to build and evaluate the Deep Learning model.  
relationship exists. Therefore it is not enough to just do integer encoding (assign each category an integer). One-hot encoding creates new binary columns for each possible unique categorical feature value. In other words, it converts the categorical data into a binary vector representation. We applied one-hot encoding to training and test subsets specifically for the following features: protocol_type, service, and flag. Ultimately, we removed the original categorical columns and obtained a dataset with 124 columns.  
The next step was the encoding of the label. For binary classification, the 'normal' value was represented by a 0, while all the others 'abnormal' were given the value 1. For multiclass classification, again, the 'normal' value was given the value 0, and the rest of the values were integer encoded. The multiclass values range from 0 to 4. This was done for both subsets.  
The next step was to strip the label and attack category columns from the train and test datasets, building the effective subsets used to generate the model. The combination of the original subset with the label column is used for the binary classification, while the combination with the attack category column is used for the multiclass classification.Thus, we divided the training and the testing subsets into 6 subsets: \(train_{f},train_{\ell},train_{c},test_{f},test_{\ell}\), and \(test_{c}\). The subsets \(train_{f}\) and \(test_{f}\) contain all the columns with the features of the original training and testing datasets except for label and attack category columns: they will be given to the model as the input. The label column for training and testing for binary classification went in \(train_{\ell}\) and \(test_{\ell}\), respectively, while the attack category column went in \(train_{c}\) and \(test_{c}\).  
The last preparation step was to normalize the data in the \(train_{f}\) and \(test_{f}\) subsets using the min-max method. For every feature, the minimum value is changed to 0, the maximum value is changed to 1, and every other value is transformed into a decimal value between 0 and 1 using the following formula \(\frac{value-min}{max-min}\). The final subsets used, \(train_{f}\) and \(test_{f}\), now contain 123 columns each, and all the data is encoded into numerical values and normalized.