# Image-Based Malicious Network Traffic Detection Framework: Data-Centric Approach
## 3 Proposed Detection Framework
### Data Preprocessing and Feature Engineering
#### 3.3.3 Information Gain-Based Feature Selection  
Commonly used feature selection methods include wrapper-based methods, embedded methods, and filter-based methods [72]. Wrapper methods select features based on specific classifier performance, making them computationally expensive. Embedded methods perform feature selection during the model training process, but they are model-specific and can lack flexibility. On the other hand, filter-based methods, such as information gain, independently evaluate feature importance regardless of any specific classification algorithm, thus providing greater flexibility and lower computational cost [73]. Moreover, filter-based methods generally offer significantly lower computational complexity and stronger robustness against overfitting compared to wrapper and embedded methods [74]. In particular, information gain ranks features based on entropy, effectively identifying informative attributes and eliminating irrelevant ones. These characteristics make information gain especially suitable for anomaly detection tasks involving high-dimensional datasets. Thus, information gain was chosen as the dimensionality reduction method for the feature selection step in this study to address the curse of dimensionality problem [75; 76]. After measuring the information gain value for each feature, the dimensionality is reduced by removing features with relatively low information gain values. To calculate information gain, the entropy of the dataset must first be quantified. Entropy is a funda  
Figure 3: The results before and after feature value normalization. (**a**) Data distribution before applying log scaling. (**b**) Data distribution after applying log scaling. mental concept from information theory, representing data uncertainty and the uniformity of distribution within a dataset. Higher entropy indicates greater diversity among samples, while lower entropy indicates more similarity. The main equations for information gain and entropy are as follows [77]:  
\[H(S)=-\sum_{i=1}^{n}p_{i}\log_{2}p_{i} \tag{2}\]  
\[H(S|F)=-\sum_{i=1}^{m}p_{i}H(S|F=f_{i}) \tag{3}\]  
\[I.G(S,F)=H(S)-H(S|F) \tag{4}\]  
where \(S\) denotes the set of data samples, and \(F\) denotes the set of features of data samples. \(H(S)\) denotes the entropy of dataset \(S\). \(n\) denotes the number of classes of dataset, and \(p_{i}\) denotes the ratio of data belonging to class \(i\) in dataset \(S\). Equation (3) calculates the conditional entropy of dataset \(S\) given feature set \(F\). The result value indicates how well the data is distinguished by the feature set \(F\). By using Equations (2) and (3), the information gain of each feature can be calculated. Table 4 shows the information gain (IG) values for 41 features of the NSL-KDD dataset. The information gain values were calculated using the Weka InfoGainAttributeEval API [78]. A larger value indicates a higher importance of the feature. As shown in Table 4, _src_bytes_ has the largest value among the features, which means that the feature can distinguish malicious and benign traffic most effectively. Conversely, features such as _num_outbound_cnds_, _num_shells_, and _urgent_ have IG values of 0, indicating these features provide no discriminative information for classification.