# Deep Learning-Based Symptomizing Cyber Threats Using Adaptive 5G Shared Slice Security Approaches
## 2 Materials and Methods
### Input Feature--Vector Selection  
The process of meaningful feature selection and utilizing these features to train an ML model is mandatory when dealing with large amounts of data. ML supports numerous arrangements for data handling, comprising NetFlows and pcap packet-capture data [21]. Scenario 11 of the CTU-13 dataset has been selected for threat symptomizing. The dataset holds three labels, namely \"background\", \"Normal\", and \"Botnet\". The dataset contains labeled data with multiple real botnet attack vectors rather than simulated ones, which have been used for the training and testing of the opted models. Before model evaluation, it is necessary to pre-process and normalize the selected data as filtered input vectors for the DL model to achieve better performance. The data columns have many values, such as source IP addresses and multi-range data columns, which cannot be transformed into suitable input data vectors, and also low-scope or parsing value data columns, which cause delays in model execution. All such data columns are removed from the dataset to decrease the data size. The remaining columns, such as \"Dir\" and \"Proto\" with low cardinality but retaining categorical values, are considered for pre-processing. The \"Dir\" column has 6 categories, and the \"Proto\" column has 13 categories. The categorical columns are \"one-hot\" encoded to binary input vectors. Encoding is used to transform the categorical column into single-value binary columns. In addition, the dataset with large-scale data columns, such as \"Dur\", \"Tot-Pkts\", \"Src-Bytes\", and \"Tot-Bytes\", may exhaust memory or cause an interruption in the training process. This problem has been addressed via the normalization of such columns in a range close to the \"0\" and \"1\" values, and the large-scale data columns are listed with min-max values, as seen in Table 1.  
Moreover, the \"sTos\" and \"dTos\" columns carry null values and have been removed from the data. Indeed, ML models tend to acquire majority-class features and have a penchant for over-fitting. During training cycles, models have achieved accuracy mostly in the majority class. To avoid this data imbalance, oversampling is used. Here, the Synthetic minority oversampling technique (SMOTE) is used to add multiple minority-class sample groups, as represented in Figure 3. The default minority class samples induction ratio is k = 5, which designates a close neighbor of the same class. Near the boundary between minority samples and their closest neighbors, synthetic samples are produced.  
\begin{table}
\begin{tabular}{c c c} \hline \hline  & **Min Value** & **Max Value** \\ \hline Dur (secs) & 0.0 & 971.284058 \\ Tot-Pkts (count) & 1 & 498,932 \\ Tot-Bytes (count) & 60 & 480,143,707 \\ Src-Bytes (count) & 0 & 22,872,870 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Large-scale data columns.  
Figure 2: Proactive and adaptive cyber defense system design flow-graph.  
The target column \"label\" contains the output labels of normal and anomalous classes. We mapped the label \"0\" for \"Background and Normal\" data and \"1\" for \"Botnet\" data. We defined Class \"0\" as a normal class and Class \"1\" as an anomalous class.