## 3 Proposed Approach
### Data Preprocessing
#### 3.2.1 Removing Outliers Using Z-Score and Local Outlier Factor (LOF)  
Z-score was applied to detect and filter out extreme outliers in the dataset. Specifically, the zscore function from the scipy.stats module calculated the z-scores for all features in the DataFrame. Z-scores represent how far a data point is from the mean in terms of standard deviations. A threshold of 6 was set, meaning any data point with a z-score greater than 6 in any feature was considered an outlier and removed. This process was applied for both binary and multi-class classification to ensure that the dataset remained clean and free of extreme outliers. Following the z-score, the LOF method was implemented to further detect and eliminate outliers. LOF identifies data points with significantly lower density compared to their neighbors, making it particularly effective for datasets with varying density distributions. The LOF was configured with n_neighbors set to 20 and contamination set to 0.1, indicating that 10% of the data were expected to be outliers. After fitting the LOF model, samples were classified as either outliers (labeled \(-1\)) or inliers (labeled 1). Only the inlier samples were retained, resulting in a cleaner dataset for subsequent analysis. This dual approach of outlier removal enhanced the performance and reliability of the classification models for both binary and multi-class tasks. (i) Binary Classification  
The NF-UNSW-NB15-v2 dataset underwent z-score to remove extreme outliers, ensuring higher data quality for binary classification. Outliers were identified and removed based on how far data points deviated from the mean, improving the dataset's reliability. As shown in Table 4, the Benign class was reduced from 96,432 to 93,653 samples after outlier removal. Similarly, other attack categories, such as Exploits and Fuzzers, decreased from 18,804 to 17,576 and 12,999 to 11,695 samples, respectively. Smaller classes, including Shellcode, Backdoor, and Worms, also experienced slight reductions. This filtering process ensured that both majority and minority classes remained balanced while minimizing the impact of noise and outliers on the classification model's performance. The sample distribution of the NF-UNSW-NB15-v2 dataset in binary classification is presented in Table 5, highlighting the impact of the LOF method on the dataset. Before applying LOF, the class Benign consisted of 93,653 samples, which decreased to 85,680 samples after outlier removal. Other classes also experienced significant reductions; for instance, Exploits reduced from 17,576 to 14,969, while Fuzzers dropped from 11,695 to 10,116. Smaller classes, such as Shellcode, decreased from 886 to 605, and Backdoor saw \begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Class Type**} & **Number of Samples Before** & **Number of Samples After** \\  & **Z-Score** & **Z-Score** \\ \hline Benign & 96,432 & 93,653 \\ \hline Exploits & 18,804 & 17,576 \\ \hline Fuzzers & 12,999 & 11,695 \\ \hline Reconnaissance & 7121 & 6883 \\ \hline Generic & 3810 & 3211 \\ \hline DoS & 2677 & 2180 \\ \hline Shellcode & 900 & 886 \\ \hline Backdoor & 547 & 322 \\ \hline Analysis & 490 & 324 \\ \hline Worms & 104 & 89 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Sample distribution of NF-UNSW-NB15-v2 dataset in binary classification using z-score. a reduction from 322 to 233 samples. The Worms class remained relatively stable, with a slight decline from 89 to 87 samples. This filtering process ensured a cleaner dataset, facilitating more accurate classification while reducing the influence of outliers on model performance. The adjustments made through LOF provide a balanced representation of both majority and minority classes, enhancing the reliability of the classification tasks. (ii) Multi-Class Classification  
The sample distribution of the NF-UNSW-NB15-v2 dataset in multi-class classification is summarized in Table 6, which illustrates the effects of z-score on the dataset.