# Image-Based Malicious Network Traffic Detection Framework: Data-Centric Approach
## 3 Proposed Detection Framework
### Data Preprocessing and Feature Engineering
#### 3.3.2 Data Normalization  
In the previous data transformation step, categorical features were converted into numeric feature vectors using label encoding. However, the numeric feature vectors in the NSL-KDD dataset exhibit different ranges and scales, which can cause biased or inefficient learning in CNN models if used directly. For instance, certain features such as packet sizes or byte counts typically have extremely large and skewed value distributions, potentially dominating the learning process. Thus, data normalization is an essential step to align the numeric features into a consistent and standardized scale.  
The NSL-KDD dataset includes numeric feature vector types of integer, float, and binary. For integer and float types of feature values, the logarithm function is applied, as shown in Equation (1). Then, it is normalized to the range from 0 to 255 to match the intensity range of grayscale image pixels.  
\[x_{\text{scaled}}=\log(x_{i}) \tag{1}\]  
This normalization range corresponds directly to the standard grayscale image pixel value range (0-255), enabling a direct and natural transformation from features to image representation. In this study, logarithmic scaling is used instead of Min-Max or Z-score normalization, as it offers several advantages in handling the characteristics of network traffic data. Logarithmic transformation effectively handles the large value ranges and skewed distributions commonly found in network traffic features such as byte counts and packet sizes. Unlike linear scaling methods, logarithmic transformation better preserves the relative differences between smaller values while compressing the effect of outliers and extreme values, which are common in network traffic due to sporadic bursts or anomalous behaviors.  
Figure 3 shows the results before and after feature scaling for the _src_bytes_ and _dst_bytes_ features, which have high IG values.  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Feature Name** & **Categorical Feature** & **Numeric Feature** \\ \hline \multirow{8}{*}{service} & ftp\_data & 3 \\  & other & 6 \\  & private & 9 \\  & http & 12 \\  & remote\_job & 15 \\  & name & 18 \\  & netbios\_ns & 21 \\  & eco\_i & 24 \\  & mtp & 27 \\  & telnet & 30 \\  & \(\cdots\) & \(\cdots\) \\  & netbios\_ssn & 186 \\  & rje & 189 \\  & X11 & 192 \\  & urh\_i & 195 \\  & http\_8001 & 198 \\  & aol & 201 \\  & http\_2784 & 204 \\  & tftp\_u & 207 \\  & harvest & 210 \\ \hline \hline \end{tabular}
\end{table}
Table 3: _Cont._Binary-type feature values are composed of two values, 0 or 1; here, 0 is not converted, and 1 is converted to 255. This binary conversion ensures maximum contrast between the presence (255) and absence (0) of binary features in the generated grayscale image, making these patterns more distinguishable for the CNN model.  
Before applying feature scaling, the two features have different scales, which is shown in Figure 3a. After applying feature scaling, however, the data samples are shown to be distributed within a similar scale, which indicates that the ratio of distances between samples is well-balanced and there is no bias towards a particular feature.  
The logarithmic transformation particularly benefits features like src_bytes and dst_bytes, which typically exhibit exponential or power-law distributions in network traffic. As shown in Figure 3b, after applying log scaling, previously imperceptible differences between smaller values become more distinguishable, while extremely large values no longer dominate the feature space. This balanced representation prevents the CNN from overemphasizing features with naturally larger numerical ranges and ensures that all relevant patterns contribute proportionally to the learning process.