# LLM-Based Cyberattack Detection Using Network Flow Statistics
## 2 Materials and Methods
### Training the Cyberattack Detection System
#### 2.3.3 Undersampling  
Table 4 contains an analysis similar to that performed for Table 3 but classifies the dataset into two types of network flows, that is, benign and malignant. The original dataset exhibited a significant class imbalance because the number of benign instances far exceeded the number of malignant ones. Originally, the dataset contained 13,484,708 benign rows and 2,748,235 malignant rows, accounting for 83.07% and 16.93%, respectively. The data cleaning process removed a substantial number of rows, but disproportionately affected the benign class. This further exacerbated the existing class imbalance. Even after cleaning, the dataset remained highly imbalanced, with 13,352,392 benign rows and 2,352,951 malignant rows. It is worth noting the proportion of data removed for both benign and malignant types of attacks, being 0.98% benign and 14.38% malignant, which corresponds to 132,316 and 395,284 rows, respectively. \begin{table}
\begin{tabular}{c c c c c} \hline
**Step** & **Rows** & **Removed Rows** & **Columns** & **Removed Columns** \\ \hline Initial status & 16,232,943 & & 84 & \\ Removal of useless columns & 16,232,943 & & 80 & 4 \\ Removal of columns with unique values & 16,232,943 & & 72 & 8 \\ Removal of columns with high correlation & 16,232,943 & & 45 & 27 \\ Removal of infinite, empty and null values & 16,137,183 & 95,760 & 45 & \\ Removal of duplicate rows & 15,705,343 & 431,840 & 45 & \\ \hline \end{tabular}
\end{table} 
Table 2: Summary of data cleaning results. \begin{table}
\begin{tabular}{l c c c c} \hline
**Types of Attacks** & **Initial** & **After** & **Removed** & **Removed** \\  & **Rows** & **Cleaning** & **Rows** & **Proportion** \\ \hline Benign & **13,484,708** & **13,352,392** & **132,316** & **0.98\%** \\ DDoS attacks-LOIC-HTTP & 576,191 & 576,175 & 16 & 0.00\% \\ DDOS attack-HOIC & 686,012 & 668,461 & 17,551 & 2.56\% \\ DoS attacks-Hulk & 461,912 & 434,873 & 27,039 & 5.85\% \\ Bot & 286,191 & 282,310 & 3881 & 1.36\% \\ Infiltration & 161,934 & 160,604 & 1330 & 0.82\% \\ SSH-Bruteforce & 187,589 & 117,322 & 70,267 & 37.46\% \\ DoS attacks-GoldenEye & 41,508 & 41,455 & 53 & 0.13\% \\ DoS attacks-Slowloris & 10,990 & 10,285 & 705 & 6.41\% \\ DDOS attack-LOIC-UDP & 1730 & 1730 & **0** & **0**\% \\ Brute Force -Web & 611 & 611 & **0** & **0**\% \\ Brute Force -XSS & 230 & 230 & **0** & **0**\% \\ SQL Injection & **87** & **87** & **0** & **0**\% \\ DoS attacks-SlowHTTPTest & 139,890 & 19,462 & **120,428** & **86.09\%** \\ FTP-BruteForce & 193,360 & 39,346 & **154,014** & **79.65\%** \\ \hline  & 16,232,943 & 15,705,343 & 527,600 & 3.25\% \\ \hline \end{tabular}
\end{table} 
Table 3: Statistics of the data cleaning process by type of attack. Class imbalance can significantly impact the performance of machine learning models. Models trained on imbalanced datasets may become biased towards the majority class, leading to poor performance in the minority class. To address the severe class imbalance, the authors applied the undersampling technique, which is a widely used technique for addressing class imbalance. It involves reducing the number of instances in the majority class to match the number of instances in the minority class. Therefore, we agreed to balance the dataset with a proportion of approximately 50% benign data and 50% malignant data. We thus decided to randomly select 20% benign rows, resulting in a more balanced dataset, in terms of proportions between classes, and a balanced dataset in terms of proportions between benign and malignant data. Table 5 shows the final number of rows and their proportion for each class, after cleaning and after performing an undersampling of 20% benign network flows. The final proportions were slightly more balanced, since there are 53.16% benign rows, and the proportions of malignant labels increased by 313%. Therefore, after undersampling, the malignant types with the most rows had 13.31%, 11.47%, and 8.66%, for the classes DDOS attack-HOIC, DDoS attacks-LOIC-HTTP, and DoS attacks-Hulk, respectively.