## 3 Proposed Approach
### Data Preprocessing
#### 3.2.2 Feature Selection Using Correlation Technique  
Feature selection was conducted based on the correlation of features with the target variable, 'Target', in the dataset, applicable to both binary and multi-class classification tasks. Initially, the features and target variable were separated, and a correlation matrix was computed by concatenating the features and the target. The absolute correlation values were extracted and sorted to identify the strength of relationships between each feature and the target variable. A correlation threshold of 0.01 was set to filter out features with weak correlations, allowing only those with significant relationships to be retained. The target variable, 'Target', was subsequently removed from the list of selected features. To address potential multicollinearity, the code calculated the absolute correlation matrix for the selected features and examined the upper triangle to avoid redundancy. Any features exhibiting a correlation greater than 0.9 were flagged for removal. The final dataset comprised the selected features that demonstrated meaningful correlations with the target variable while mitigating issues related to multicollinearity. This process ensured a robust input for subsequent analyses or model training in both binary and multi-class classification contexts.  
(i) Binary Classification  
The selected features from the NF-UNSW-NB15-v2 dataset for binary classification, identified using a correlation technique, are detailed in Table 8. These features were carefully chosen based on their significant correlation with the target variable, ensuring their relevance for the classification task. The selected features include metrics such as MAX_TTL and MIN_IP_PKT_LEN, which provide insights into packet attributes, as well as network behaviors like SRC_TO_DST_AVG_THROUGHPUT and DST_TO_SRC_AVG_THROUGHPUT. Additionally, protocol-specific characteristics are captured through features like PROTO  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Class Type** & **Number of Samples Before LOF** & **Number of Samples After LOF** \\ \hline Benign & 93,530 & 85,510 \\ \hline Exploits & 17,492 & 14,933 \\ \hline Fuzzers & 11,730 & 10,131 \\ \hline Reconnaissance & 6881 & 6774 \\ \hline Generic & 3234 & 2688 \\ \hline DoS & 2195 & 1730 \\ \hline Shellcode & 886 & 614 \\ \hline Backdoor & 327 & 243 \\ \hline Analysis & 330 & 316 \\ \hline Worms & 92 & 88 \\ \hline \hline \end{tabular}
\end{table}
Table 7: Sample distribution of NF-UNSW-NB15-v2 dataset in multi-class classification using LOF.  
COL and L4_DST_PORT, while metrics like FLOW_DURATION_MILISECONDS and NUM_PKTS_128_TO_256_BYTES offer a deeper understanding of traffic patterns. Overall, this selection aims to enhance the model's ability to accurately differentiate between benign and malicious activities in network traffic.  
2. Multi-Class Classification The selected features from the NF-UNSW-NB15-v2 dataset for multi-class classification, identified using a correlation technique, are outlined in Table 9. These features were chosen for their significant correlation with the target variable, enhancing the model's ability to distinguish among various classes effectively. Key features include MIN_TTL and MIN_IP_PKT_LEN, which provide important information about packet characteristics, alongside metrics like DST_TO_SRC_AVG_THROUGHPUT and SRC_TO_DST_AVG_THROUGHPUT, which capture network traffic flow dynamics. Additionally, protocol-related attributes are represented through features such as PROTOCOL and L4_SRC_PORT, while metrics like DURATION_IN and LONGEST_ FLOW_PKT offer insights into session behavior. This selection aims to improve the classification performance by retaining features that exhibit strong correlations with the output variable across different classes.