# Model Retraining upon Concept Drift Detection in Network Traffic Big Data
## 3 Data and Preprocessing
### Data Preprocessing
#### 3.2.3 Binning the Data  
Continuous features, especially features with a wide range of values, were binned into discrete categorical intervals. Features with too many less significant counts in certain categories were grouped or binned into fewer, more manageable categories. As presented in Table 3, UVF-ZeekDataFall22 has mainly five different tactics: Resource Development, Reconnaissance, Discovery, Privilege Escalation, and Defense Evasion. Tactics that were very low in numbers were grouped into the \"Other\" category. Tables 4 and 5 display the distribution and binning of the protocol and service features, respectively. Protocol is the transport layer protocol of the connection and service is the identification of the application protocol being sent over the connection [23]. \begin{table}
\begin{tabular}{c c c} \hline
**Protocols** & **Binned Value** & **Distribution** \\ \hline UDP & 0 & 55.47\% (388,470 records) \\ \hline TCP & 1 & 44.39\% (310,910 records) \\ \hline ICMP & 2 & 0.14\% (960 records) \\ \hline \end{tabular}
\end{table} 
Table 4: Distribution and binning of protocol. \begin{table}
\begin{tabular}{l c c} \hline
**Tactics** & **Binned Value** & **Definition** & **Distribution** \\ \hline None & 0 & Benign data & 50.02\% \\ \hline Resource & 1 & \begin{tabular}{c} Tactic involves an adversary setting up resources to \\ maintain access and advance their attack [24] \\ \end{tabular} & 39.33\% \\ \hline Reconnaissance & 2 & \begin{tabular}{c} The process of collecting initial information or \\ intelligence about a target [25] \\ \end{tabular} & 7.35\% \\ \hline Discovery & 3 & Adversary will seek information on the system [26] & 2.40\% \\ \hline Privilege Escalation & 4 & \
\begin{tabular}{c} Tactic involving various techniques adversaries use \\ to gain higher-level permissions within a system or \\ network [27] \\ \end{tabular} & 0.44\% \\ \hline Defense Evasion & 5 & Uses methods to avoid being detected [28] & 0.44\% \\ \hline Other Categories & 6 &
\begin{tabular}{c} Includes the following: Lateral Movement, \\ Execution, Command and Control, Persistence, \\ Collection, and Initial Access [20] \\ \end{tabular} & 0.02\% \\ \hline \end{tabular}
\end{table} 
Table 3: Distribution and binning of tactics. \begin{table}
\begin{tabular}{c c c} \hline
**Features** & **Range** \\ \hline Original Bytes & 0 to 218,820 \\ Response Bytes & 0 to 2,174,312 \\... &... \\ \hline \end{tabular}
\end{table} 
Table 2: _Cont._ \begin{table}
\begin{tabular}{c c c} \hline
**Service** & **Binned Value** & **Count** \\ \hline dns & 0 & 381,896 \\ dhcp & 2 & 633 \\ http & 3 & 168 \\ ntp & 4 & 169 \\ ssl & 5 & 37 \\ \hline \end{tabular}
\end{table} 
Table 5: Distribution and binning of service. \begin{table}
\begin{tabular}{c c} \hline \hline
**Category** & **IP Address** \\ \hline Invalid IP & \\ Private (RFC 1918) & Class A 10.0.0.0/8 \\ Private (RFC 1918) & Class B 172.16.0.0/12 \\ Private (RFC 1918) & Class C 192.168.0.0/16 \\ Public IP & Known Services (80, 443, etc.) \\ Public IP & Other \\ Localhost & 127.0.0.0/8 \\ Link-local & 169.254.0.0/16 \\ Special & Multicast, Reserved (RFC 6890) \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Distribution and binning of IP addresses. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Category** & **Port Range** \\ \hline Well Known & 1–1023 \\ \hline Registered & 1024–49,151 \\ \hline Dynamic & 49,152–65,535 \\ \hline Invalid & 0 or none \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Distribution and binning of ports. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Conn\_State** & **Binned Value** & **Count** \\ \hline S0 & 0 & 587,615 \\ \hline SF & 1 & 75,749 \\ \hline SHR & 2 & 5249 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Distribution and binning of conn_state.