## 3 Dataset  
The CIC-IDS2017 and CSE-CIC-IDS-2018 (an extension to the CIC-IDS-2017 dataset with more network traffic data) datasets have become popular in the research community, particularly in the field of IDSs. The CIC-IDS2017 dataset was generated from real network recordings.  
The data collection period started on Monday 3 July 2017 at 9.00 a.m. and ended on Friday 7 July 2017 at 5.00 p.m. for a total of 5 days. Each dataset record contains 79 parameters, the last of which is an output with 15 different names (classes) indicating to which type of malicious activity, if any, the network packet described in the dataset record belongs. All possible output values and their proportions in the overall dataset are shown in Figure 1.  
The CSE-CIC-IDS-2018 dataset is larger than the CIC-IDS2017 dataset in terms of the number of flows it contains, with more than 80 million flows compared to about 3 million flows in the CIC-IDS2017 dataset. This dataset includes not only the attack types identified in the CIC-IDS2017 dataset, but also several new attack types commonly found in web applications, such as SQL injection, cross-site scripting (XSS) and command injection. These attacks can be particularly damaging because they target vulnerabilities in the application itself, allowing attackers to gain unauthorized access to sensitive data or to take control of the system. SQL injection attacks and XSS attacks are two common types of web application attacks that can be very harmful. SQL injection attacks occur when an attacker is able to inject malicious SQL code into a web application's input fields. If the application does not  
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**Method** & \multicolumn{1}{c}{**Classifier**} & \multicolumn{1}{c}{**F1-Score, (\%)**} & \multicolumn{1}{c}{**Classes**} \\ \hline [PERSON], [PERSON] et al. [40] & LSTM & 99.00 & 10 \\ \hline [PERSON] et al. [41] & LGBM (Light GBM) & 99.94 & 7 \\  & XGBoost & 99.92 & \\ \hline [PERSON] et al. [42] & MLP-BP (Multi-layer perceptron + backpropagation) & 99.20 & 7 \\  & MLP-PSO (multi-layer perceptron + particle swarm optimization) & 97.60 & \\ \hline \hline \end{tabular}
\end{table}
Table 2: _Cont._properly validate or sanitize the user input, the malicious code can be executed by the database, allowing the attacker to access, modify or delete sensitive data. XSS attacks, on the other hand, involve injecting malicious scripts into a web application's pages. This can allow attackers to steal sensitive information, such as cookies or login credentials, or to gain control of the user's browser, redirecting them to other malicious sites or launching further attacks.  
Regarding the output imbalance problem, we can see that the situation is very similar to the 2017 dataset (the dominant class accounts for 82.66% of the dataset), so it would make sense to merge them (see Figure 2). By merging the datasets, the total number of examples in the minority class would increase. Additionally, by keeping only the entries that have a certain number of entries, it would be possible to remove any outliers or rare classes that may not have enough examples to train the classification model effectively.