## 4 Experimentation and Evaluation
### Feature Selection Methodology
#### 4.1.2 Data Balancing Method  
Then, the distributions of classes are evaluated. The significant disparity between them indicates that the dataset is unbalanced. An unbalanced dataset implies a substantial difference in the number of records to classify and can negatively impact the model, primarily by causing overfitting. This may mean that our models tend to learn to classify the majority class or classes, ignoring the rest and not affecting metrics such as accuracy. Therefore, the study in the following subchapters is conducted with the unbalanced or non-balanced (SB) dataset and the balanced (B) dataset to observe which models perform more effectively.  
To balance the dataset, we opted for oversampling, which involves duplicating samples from minority classes to match those of the majority classes. For this process, multiple methods based on mathematical correlations of the attributes with the target label were analyzed, such as Kendall, Pearson, or Spearman correlation. Kendall correlation was used, which is a non-parametric method that utilizes the ranking of observations. It is similar to Pearson's correlation but is more commonly employed when parameters are not standardized, making it important to highlight the following information:  
* The correlation result ranged between \(1\) and \(-1\) (perfect positive correlation and perfect negative correlation);
* They were used as a measure of the strength of association between two variables, meaning they quantified the effect size. It can be said that a value of \(0\) is a null correlation, between \(0.1\) and \(0.3\) a (\(0.1\)-\(0.3\)) small association, between \(0.3\) and \(0.5\) a (\(0.3\)-\(0.5\)) medium correlation, between \(0.5\) and \(0.7\) a (\(0.5\)-\(0.7\)) moderate association, and  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Type** & **Distribution** \\ \hline Normal & 9625 \\ Anomaly & 26,118 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Distribution of UNSW-NB15 dataset categories used in anomaly and normal traffic for the dataset after preprocessing.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Type** & **Codification** & **Distribution** \\ \hline Analysis & 0 & 564 \\ Backdoor & 1 & 11 \\ DoS & 2 & 717 \\ Exploits & 3 & 5293 \\ Fuzzers & 4 & 535 \\ Generic & 5 & 18,460 \\ Reconnaissance & 6 & 504 \\ Worms & 7 & 34 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Distribution of classes after preprocessing.  
higher a high or very high association. Using the Pandas library, correlation matrices were obtained for the four possible combinations by selecting the associated features from the proposed ranges.  
Upon applying the previously mentioned methodology, coefficients greater than 0.45 were selected for both balanced and unbalanced datasets for binary classification. For the multiclass classification approach, a coefficient greater than 0.75 was chosen for the unbalanced dataset due to the high correlation factor between the features. Moreover, for the balanced dataset, a coefficient greater than 0.22 was selected due to a low correlation factor between the features. The selected metrics are the following for each of the mentioned datasets:  
* _Binary class (B):_ dimpkt, ct_dst_src_ltm,bytes, dpkts, dbytes, ct_src_dport_ltm, dmean, ct_dst_sport_ltm, dload, state, sttl, ct_state_ttl;
* _Binary class (SB):_ dbytes, dpkt, ct_dst_sport_ltm, dmean, state, dload, ct_state_ttl, sttl;
* _Multiclass (B):_ sload, dloss, dload, dbytes, response_body_len, dmean, sttl;
* _Multiclass (SB):_ dmean, ct_state_ttl, state_FIN, service_dns, swin, dwin, proto_tcp, proto_udp, dttl, state_INT.