## 3 Methodology
### Methods
#### 3.2.2 Constructing Time Series Data with a Pre-Defined Time Scale \(t_{s}\)  
Time series data are constructed by mapping a set of network traffic data series in \(t_{s}\) to values over time through the extraction of temporal features. First, the original data is segmented with a pre-defined time scale \(t_{s}\). A new time index is created depending on the pre-defined time scale \(t_{s}\) over time, \(\
abla t_{i}=(t_{s}*c)-\
abla t_{i-1},c=2,\cdots,t_{N},i=2,\cdots,t_{N},\
abla t _{1}=t_{s}\) where \(t_{N}=\frac{m_{t}}{t_{s}}\), \(m_{t}\) is a maximum time. Thus, a new time index is generated as \(\
abla t_{i}=\{i^{\prime}_{1},i^{\prime}_{2},\cdots,t^{\prime}_{N}\}\). Within each time index, \(\
abla t_{i}\) contains a series of tuples \(\{(X_{i},Y_{i})\}\) forming M \(\times\) J matrix \((X_{i}\in R^{M\times J})\) and M \(\times\) D matrix \((Y_{i}\in R^{M\times D})\), where \(M(M\geq 1)\) indicates the total number of observations at time \(\
abla t_{i}\), \(J\) represents the total number of variables, and \(D(D\geq 1)\) denotes the size of dependent variables. It is important to note that the size of \(M\) may vary because the number of network events occurring over time is different. For the one-hot encoded dependent variables, the frequency of network events over \(\
abla t_{i}\) is computed as \(\mathcal{C}(Y_{i}^{k})=\Sigma_{1}^{n_{t}}I_{Y_{i}}(\delta_{i})\), where \(\delta_{i}\) indicates if each network event is normal or an attack. The frequency of each one-hot encoded variable over \(\
abla t_{i}\) is also measured for the nominal variables. For instance, for the variables (source and destination port numbers), the number of used port numbers over \(\
abla t_{i}\) are counted. For the other variables, a representative value for each \(M-\)dimensional vector over \(\
abla t_{i}\) is measured to generate time series data with equal intervals. In this paper, we present a methodology that utilizes wavelet transform (DWT [33]) and permutation entropy (PE [34]) to map values from the original time sequences into time series features. The advantages of employing these techniques (i.e., DWT and PE) include the capability to identify sudden network event changes and to illustrate the trend of network event behaviors over time. DWT is well-suited for analyzing non-stationary data, such as network traffic, in both time and frequency domains. It achieves this by continually decomposing the data into two sub-bands. That is, detail and approximation coefficients are produced by successively passing data through high-pass and low-pass filters until they reach a predefined level. The coefficients represent time and frequency information associated with each decomposition level by the following:  
\[\mathcal{W}_{c}= <d(t),\phi_{(\tau,\gamma)}> =\int_{-\infty}^{\infty}d(t)\phi_{(\tau,\gamma)}dt\]  
where \(d(t)\) indicates data, \(\phi_{(\tau,\gamma)}(t)\) represents a mother wavelet function, and \(\tau\) and \(\gamma\) denote frequency resolution (i.e., scale) and shift parameters, respectively. Approximation coefficients \((a_{(\tau,\gamma)})\) present low-frequency information, while the detailed coefficients \((d_{(\tau,\gamma)})\) show the high-frequency characteristics of data. PE is applied to analyze the wavelet coefficients. It is a complexity measurement that integrates symbolic patterns and entropy. Specifically, we used the coefficients, \(a_{(\tau,\gamma)}\), \(d_{(\tau,\gamma)}\), and \(a_{(\tau,\gamma)}+d_{(\tau,\gamma)}\) to extract features. PE is used to construct subsequences \((s_{i})\) with a pre-defined embedding dimension \((e_{d})\). Then, each subsequence is mapped into a unique permutation to capture the order as \(\pi(i)=\{0,1,\cdots,e_{d}\}\). The probability distribution of the permutation is computed as \(p_{\pi(i)}=\frac{\delta_{\pi(i)}}{|s_{i}|}\), where \(\delta_{\pi(i)}\) presents the occurrence of the pattern \(\pi(i)\). Lastly, [PERSON]'s rule [35] is utilized to calculate the permutation entropy as \(\Sigma_{i}-p_{\pi(i)}\times log(p_{\pi(i)})\).