## 3 ENN  
ENN is an advanced data preprocessing method designed to enhance the quality of training datasets by removing noisy and misclassified instances, ultimately refining class boundaries. This technique operates by evaluating the nearest neighbors of each data point and discarding those that are incorrectly classified, thereby improving the clarity and distinction between classes. Through this process, ENN effectively reduces class overlap, promoting a more balanced representation across the dataset. This is particularly beneficial for both binary and multi-class classification tasks, as it ensures that the training data are cleaner and more accurately reflect the underlying patterns. When integrated into the preprocessing pipeline, ENN aids in achieving better model generalization, leading to enhanced performance when applied to new, unseen data [46]. For each instance \(X_{i}\) in the dataset, its k-nearest neighbors are identified using the formula in Equation (7) [46]. \[N(X_{i})=\left\{X_{j1},\ X_{j2},\ldots\ldots,\ X_{jk}\right\} \tag{7}\]  
where \(X_{jk}\) are the nearest neighbors of \(X_{i}\) in terms of a distance metric (e.g., Euclidean distance). To determine the majority class among the nearest neighbors, the approach outlined in Equation (8) [46] was used. This process involved examining the class labels of the nearest neighbors and identifying the class that appeared most often. By leveraging this method, the predicted class for an instance can be assigned based on the most frequent class within its neighborhood, thus improving the model's classification accuracy by ensuring it reflects the dominant pattern in the surrounding data points. \[C(X_{i})=argmax_{c}\left(\sum_{j=1}^{k}\prod(y_{j}=c)\ \right) \tag{8}\]  
where \(C(X_{i})\) denotes the predicted class for instance \(X_{i}\), with \(y_{j}\) representing the class label of its \(j\)-th neighbor. The indicator function \(\prod\) outputs 1 if the condition holds true, otherwise returning 0. An instance \(X_{i}\) is discarded if the predicted class \(C(X_{i})\) differs from its true class label \(y_{j}\), as defined by the formula in Equation (9) [46]. This step helps in eliminating misclassified instances, thereby improving the quality of the dataset by retaining only those instances whose predicted and actual classes align. \[\text{If }C(X_{i})\ \
eq\ y_{j},\ \text{then remove }X_{i} \tag{9}\] \begin{table}
\begin{tabular}{c c c} \hline
**Type of Class** & \
\begin{tabular}{c} **Number of Samples Before** \\ **Resampling (SMOTE)** \\ \end{tabular} &
\begin{tabular}{c} **Number of Samples After** \\ **Resampling (SMOTE)** \\ \end{tabular} \\ \hline DoS GoldenEye & 3018 & 3018 \\ \hline FTP-Patator & 1658 & 1658 \\ \hline SSH-Patator & 735 & 735 \\ \hline DoS Slowloris & 1312 & 1312 \\ \hline DoS Slowhttptest & 943 & 943 \\ \hline Bot & 539 & 539 \\ \hline Web Attack—Brute Force & 373 & 373 \\ \hline Web Attack—XSS & 288 & 288 \\ \hline Infiltration & 13 & 13 \\ \hline Web Attack—Sql Injection & 7 & 31,172 \\ \hline Heartbleed & 9 & 31,172 \\ \hline \end{tabular}
\end{table} 
Table 9: _Cont._The sample distribution for the binary classification task on the CICIDS2017 dataset, before and after applying ENN for resampling, is shown in Table 10. Before resampling using ENN, both the Normal and Attack classes contained an equal number of 79,296 samples. However, after applying ENN, a slight reduction in the Attack class was observed, with its sample count decreasing to 79,067. This reduction occurred as ENN removed misclassified instances from the Attack class, helping to eliminate noise and improve the quality of the training data. The resulting dataset maintained a nearly balanced distribution while enhancing the clarity of class boundaries and contributing to better model performance and generalization.