## 4 Implementation
### Dataset Purification  
This section describes a dataset purification mechanism for fast outlier and noise detection. The Purification mechanism receives previous training datasets and new data, learns the trend of changed data, and returns a new training dataset removed from noise data. In this process, the Dataset purification mechanism uses a threshold to generate an appropriate dataset considering the trade-off between classification performance and training time. Algorithm 1 is the pseudo-code of our algorithm for the data set purification mechanism of the proposed methodology. The proposed method uses the unanimity threshold \(u\) for the sum of the classification results of the ensemble model. If the sum of classification results is higher than this threshold, the data is judged as pure data. These pure data are used for retraining the next model, and classification results lower than this threshold are excluded from the retraining process. At the same time, the unanimity threshold is a factor that determines how sensitively the classification model reflects the trend of newly observed data. If the unanimity threshold is high, the classification model conservatively reflects the trend, and if the unanimity threshold is low, the model actively reflects the trend of new data. This threshold may be applied differently depending on the environment of the network. In an environment where the pattern of network traffic changes frequently and a flexible decision boundary is required, it can respond by setting the unanimity threshold low. On the other hand, in a static environment where almost the same pattern is repeated, such as ICS, it is possible to respond sensitively to abnormal behavior by applying a high unanimity threshold. Figure 2: Detailed procedure flow chart for the proposed network attack detection and noise data removal. ```
Input : previous training dataset \(T\)  newly observed data \(N\)  ensemble model \(E\)  unanimity threshold \(u\)  purity threshold \(p\) Output : purified new training dataset \(P\) for each \(n_{i}\in N\)do  preds = prediction(\(E\), \(x\)) for each \(y\in preds\)do if\(sum(y)>u\)then  store \(y\) in \(U\) endif  end for  end for \(N=N\cup U\) \(l\) = length(\(N\))  model_training(\(E\), \(N\)) for each \(n_{l}\in N\)do  preds = prediction(\(E\), \(n_{l}\)) for each \(y\in preds\)do if\(sum(y)>p\)then  store \(y\) in \(P\) endif  end for return\(P\)
```  
**Algorithm 1**Data Purification Mechanism. The dataset purification mechanism selects data for retraining and merges them with the existing training dataset. This new dataset is used to update the classification model temporarily. Then, the updated model performs recursive classification on the dataset used to train the model. After that, for the recursive classification results, data to be included in the final training dataset is selected based on the sum of the classification result values of the sub-models of the classification model. Dataset purification mechanism removes new noise data in the classification models reflecting new data trends. This process can adjust the size of the training dataset by tuning the ratio of increasing new data to decreasing noise data. In this process, the purity threshold \(p\) is used. Like the unanimity threshold, this threshold refers to the reflection rate of trends and determines the rate of change in the size of the training dataset. The purity threshold is inversely proportional to the growth rate of the size of the training dataset. If the purity threshold is high, the size of the training dataset is maintained or gradually decreased. If the purity threshold value is low, the size of the training dataset continues to increase in proportion to the new data. Therefore, the purity threshold should be adjusted appropriately by considering all factors such as the amount of data observed in the network, the performance of the classification model, and the time used for learning.