## 5 Experiment
### Implementation
#### 5.3.1 Feature Selection  
Data preprocessing is a crucial step that significantly enhances the proposed model's performance. Initially, the normalization of the dataset was conducted. For the CIC-IDS2017 dataset, flows containing attributes with malformed values, or featuring \"infinity\" or \"NaN\" values in the columns \"Flow Bytes/s\" and \"Flow Packets/s\" were eliminated. Additionally, the \"Fwd Header Length\" attribute is duplicated in columns 41 and 62; hence, one instance is removed. Some columns of the dataset, such as Flow ID, Source IP, Destination IP, Timestamp, and External IP, encompass string and categorical attributes. To facilitate numerical processing, these attributes were converted into numerical format utilizing the LabelEncoder() [38] function from the Sklearn library. As for column labels, they were divided into two types of labels to serve the classification of the model. Specifically, label 0 is assigned to benign flows, while label 1 is designated for the remaining attack flows. After normalization, the features within each flow are extracted to constitute the input data for the model. The feature selection is based on the role of each type of feature in defining a different type of cyberattack. Therefore, to effectively predict each type of attack, the deep learning model requires diverse feature types. Those features are evaluated based on the \"important weight\" index initially introduced in the random forest regression algorithm [38]. The random forest method provides the advantage of assessing the importance of each feature in class prediction based on its individual score. Evaluating feature scores in a high-dimensional dataset can be challenging. To address this issue, the random forest method utilizes these importance scores to select a minimal set of highly  
Figure 8: The implementation process. discriminatory features automatically. Leveraging this index, the author of the paper [39] identified the sets of four features that exert the most influence on each type of attack. Twelve different types of attack were considered, each corresponding to a set of 4 features. With each set of these 4 features, the model can learn how to classify and predict each type of attack with the highest accuracy. In this study, we classified network flows into normal flows and attack flows. The way to select features was also introduced in the paper [39], which is to synthesize features from the sets of 4 features mentioned above. In this study, all attack types were classified under a common label of 'attack'. Thus, the 4 features obtained for each of the 12 attack types resulted in a pool of 48 features. After eliminating duplicates, the number of features was reduced to 18. We selected these 18 features for the process of creating graph data. In addition, the features \"Source IP\" and \"Destination IP\" were also selected because they are necessary for the graph creation process. Consequently, 20 features were selected from more than 80 features in each flow to construct a graph for training the model. The list of these 20 features is presented in Table 2 below. Similarly, for the UNSW-NB15 dataset, columns containing string data or categorical attributes were converted into numerical format. The 'attack-cat' column, which included a list of attack types, was removed. We utilized the 'label' column, which was labeled with label 0 for benign flows and label 1 for attack flows. The Random Forest Regression algorithm was used to assess the influence of the features based on the 'important weight' index mentioned above. This index indicates the influence of each feature in class prediction and always sums up to 1. After calculating the 'important weight', various threshold values are used to determine the optimal number of features to select. The optimal number of features is identified at the threshold where the model achieves the highest classification accuracy.