# A Complete EDA and DL Pipeline for Softwarized 5G Network Intrusion Detection
## 3 Proposed Approach
### Description
To that end, this work proposed using a custom hybrid data normalization, to ensure consistent scaling of the features and consequently facilitating the convergence of the underlying ML/DL models. More specifically, this work proposed using \"min-max normalization\" for one-hot encoded features and \"Z-score normalization\" for regular numerical features (which often follow a Gaussian distribution [47]). In the case of \"min-max normalization\", the scaled features can be calculated as follows [46]: \[X^{i}_{\text{scaled}}=\frac{X^{i}_{orig}-\min(X^{i})}{\max(X^{i})-\min(X^{i})}\] (1) where for data point \(X\), \(X^{i}_{orig}\) is the original value of feature \(i\), \(X^{i}_{\text{scaled}}\) is the scaled value of the feature, \(\min(X^{i})\) is the minimum of the feature, and \(\max(X^{i})\) is the maximum value for the feature among the data points. As a result, all the min-max normalized features have a unified scale between 0 and 1 [46]. In the case of \"Z-score normalization\", the scaled features can be calculated as follows [46]: \[X^{i}_{\text{scaled}}=\frac{X^{i}_{orig}-\mu_{X^{i}}}{\sigma_{X^{i}}}\] (2) where for data point \(X\), \(X^{i}_{orig}\) is the original value of feature \(i\), \(X^{i}_{\text{scaled}}\) is the scaled value of the feature, \(\mu_{X^{i}}\) is the mean, and \(\sigma_{X^{i}}\) is the standard deviation of feature \(i\). As a result, all the z-score normalized features have a unified scale with zero mean and unit standard deviation [46]. 2. _Feature Selection Module:_ The second module of the framework is the \"feature selection\" module. It aims to select important features, with the goal of reducing the computational complexity of the overall framework. The importance of this module is amplified by the presence of the data encoding step (specifically the one-hot encoding) in the previous module. To that end, the \"mutual information\" feature selection technique is considered in this work. 1. Mutual Information: Mutual information feature selection is the process of selecting the features that provide the highest amount of information for the output target label. Mutual information is defined as \"the amount of information that a random variable contains in another random variable\" [48]. In this case, the mutual information (referred to as \(I(X;Y)\)) between each of the input features and the output target label is calculated using the following equation [48]: \[I(X;Y)=\sum_{x\in X}\sum_{y\in Y}p(x,y)\log\bigg{(}\frac{p(x,y)}{p(x)p(y)} \bigg{)}\] (3) where \(p(x,y)\) is the joint probability density function, and \(p(x)\) and \(p(y)\) are the marginal probability density functions of variables \(X\) (in this case one of the input features) and \(Y\) (in this case the output target label). The benefit of using mutual information feature selection is threefold [49]. The first is that it is not constrained by real-valued random variables, as it computes both the joint distribution and the marginal distribution [49]. This means it can deal with both continuous (numerical) and discrete data (numerical or categorical) [50]. This is crucial in this case, since all the features are either discrete numerical or categorical features. Thus, calculation of the mutual information score is easily applied. The second benefit is that it is capable of measuring both linear and non-linear relationships, which is also essential in such environments where many of the features exhibit non-linear behavior [49]. The third advantage is that this technique ensures invariability to any reversible and differentiable data transformations, which is also important given some of the techniques employed, such as data encoding [49]. Thus, mutual information feature selection is suitable for the application and the type of data observed in this work, as there are no scenarios that could pose difficulties for its implementation. 3. _DL-based Intrusion Detection Module:_ The third module of the framework is the \"DL-based intrusion detection\" module.