## 5 Methodology
### Dataset Collection  
The process of data collection involved executing five distinct scenarios within the NS3 simulator, which facilitated the examination of network behaviors under different attack configurations. In each scenario, a carefully calibrated mix of normal and attack nodes was employed to simulate varying cyberthreat landscapes. The scenarios were strategically designed with incremental increases in the number of attack nodes and corresponding decreases in the number of normal nodes, thereby creating a spectrum of network scenarios to analyze. The orchestrated simulations allowed for the observation of packet transmission dynamics among nodes. During the simulations, each node actively participated in sending packets to other nodes, and a plethora of crucial parameters were systematically recorded. These parameters included the source and destination IP addresses, thus reflecting the communication paths within the simulated network. The data rate denoted the speed at which packets were transmitted, while the metrics of total the transmitted and received packets and bytes captured the volume of information exchanged between nodes. Additionally, the simulations meticulously tracked the number of packets and bytes dropped, lost packets, and delays associated with the transmission process. One noteworthy aspect of the recorded information was the assignment of labels to each node. These labels served as a critical attribute indicating whether a particular node was classified as normal (assigned a label of 0) or an attacker (assigned a label of 1). This labeling mechanism was pivotal for subsequent analysis, thus enabling the differentiation between benign and malicious nodes in the dataset. Table 1 shows the dataset features. Upon the completion of all five scenarios, the individual datasets were aggregated into a comprehensive dataset encompassing 15,217 samples. Each sample was characterized by 14 columns representing the diverse set of parameters recorded during the simulations. This amalgamated dataset now serves as a robust foundation for in-depth analyses, thus offering insights into the intricate dynamics of network behavior under varying cyberthreat scenarios. This study made modifications to the ERF-ABE algorithm by tailoring it to better suit the specific characteristics of the dataset. Notably, adjustments were made to key parameters, such as setting the max_features parameter to four and the random_state to 14. These alterations resulted in a refined version of the algorithm called ERF-LET, which was optimized to accommodate the nuances of the dataset and enhance its performance. The training of ERF-LET, DT, LR, and AdaBoost is described in Figure 2. A meticulous preprocessing phase was undertaken on the comprehensive dataset obtained from the orchestrated NS3.27 simulations. The initial step involved separating the label column from the dataset, which is a critical task to distinguish between normal and attacker nodes during the training process. To streamline the input features, the 'destinationAddress' and 'DataRate' columns were dropped, thus focusing on essential parameters for training. Given the categorical nature of the'sourceAddress' column, a label encoder was applied to encode the information for ensuring compatibility with the algorithm. Subsequently, the MinMaxScaler was employed to normalize the dataset to bring it within a standardized range of \((-1,1)\). This step is instrumental in mitigating the impact of varying scales among different parameters, thereby facilitating a more uniform learning process for ERF-LET, DT, LR, and AdaBoost. To assess the classifier's generalization performance, the dataset was divided into training (80%) and testing (20%) sets, with 12,174 samples for training and 3043 samples for testing. The ERF-LET, DT, LR, and AdaBoost algorithms were then trained on the designated training set, thus leveraging the preprocessed data to learn the intricate patterns of normal and malicious network behaviors.