# A Complete EDA and DL Pipeline for Softwarized 5G Network Intrusion Detection
## 3 Proposed Approach
### Description  
Figure 1 illustrates the proposed DL-based framework for softwarized 5G network intrusion detection. This framework consists of three modules, which are the \"data preprocessing module\", the \"feature selection module\", and the \"DL-based intrusion detection module\". The \"data preprocessing module\" aims to prepare the input data in a suitable manner that maximizes the performance of the subsequent layers. Its output is then fed into the \"feature selection module\", which aims to select important features, to reduce the overall computational complexity of the framework. Finally, the output of that module is then fed into the \"DL-based intrusion detection module\", which aims to detect potential malicious traffic and attacks using three different DL-based models. Figure 1: Proposed EDA and DL framework for softwarized 5G network intrusion detection. In what follows, a brief description of each of the three modules is provided. 1. _Data Preprocessing Module:_ The first module of the framework is the \"data preprocessing\" module. It aims to adequately prepare the input data in such a manner that it maximizes the performance of the subsequent modules. It consists of three steps, namely \"data cleaning\", \"data encoding\", and \"data normalization\". 1. Data Cleaning: The first step of data preprocessing is data cleaning. Data cleaning refers to the process of \"fixing systematic problems or errors in messy data\" [41]. The goal is that the quality of data is improved so that the underlying ML and DL models built upon the data are also of high quality [42]. This process consists of two main steps, error detection and error repair [41; 42]. In this work, two main data cleaning techniques are used, namely feature deletion and mean/mode replacement (a statistical technique) [43]. More specifically, features that have a high correlation between missing values and the output label are deleted, as these are considered to be extraneous to the analysis. For other features with some missing values, mean/mode replacement is used. It is worth noting that, for categorical features, missing values are replaced with the mode of the feature. On the other hand, the missing values of numerical features are replaced with the mean value [43]. This is carried out to insure that numerical bias is not added by the data cleaning process when employing error repair techniques. 2. Data Encoding: The second step of data preprocessing is data encoding. This refers to the process of transforming data/features from one format into another. Typically, this is performed to transform categorical features into numerical or integer features. In this work, two different data encoding techniques are used. The first is \"one-hot encoding\", which is used for the input categorical features [44]. This technique adds a new feature column for every potential value of an input feature using a binary indicator (i.e., either 0 or 1) to represent if the value matches the category or not [44]. The second technique is \"label encoding\", which is used for the output categorical target label feature [45]. In this case, the target label value is assigned a higher integer if it appears more often, as this reflects the importance and probability of an attack. Therefore, this combination of data encoding insures that regular categorical input features, in which the order of the values is not essential, are represented adequately, without leading the underlying ML/DL algorithm to misinterpret their importance (through using one-hot encoding), while simultaneously guaranteeing that the order is accounted for in the output target label encoding (through label encoding). 3. Data Normalization: The third step of data preprocessing is data normalization. This refers to the process of scaling the features so that they have similar ranges [46]. This is performed to ensure that the ML/DL models trained are not biased to particular features, due to them having differing magnitudes in their values.