## 3 Methods
### Data Preprocessing  
The data preprocessing phase consists of three key stages: encoding, normalization, and feature selection. The first stage, encoding, involves converting textual attributes within the dataset into numerical values to facilitate processing by artificial intelligence algorithms. Additionally, \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Attribute Name** & **Count** & **Mean** & **Std** & **Min** & **Max** \\ \hline Mean & 1,017,794 & 0.13 & 0.69 & 0 & 5.00 \\ Sport & 1,017,794 & 54,446.18 & 12,063.55 & 0 & 2,765,721.00 \\ Dport & 1,017,794 & 790.94 & 301.91 & 0 & 65,522.00 \\ SrcRets & 1,017,794 & 161.63 & 50,431.25 & 0 & 273,739.670.00 \\ DstPkts & 1,017,794 & 16.90 & 1130.98 & 0 & 309,216.00 \\ TotPkts & 1,017,794 & 170.71 & 50,431.55 & 0 & 27,739.670.00 \\ DstBytes & 1,017,794 & 728.89 & 733,509.15 & 0 & 82,515,592.00 \\ SrcBytes & 1,017,794 & 18,336.94 & 4,506,185.84 & 0 & 2,108,646.246.00 \\ TotBytes & 1,017,794 & 287,451.57 & 19,674,969.34 & 0 & 2,143,724,556.00 \\ SrcLoad & 1,017,794 & 157,101,849.65 & 83,370,738.15 & 0 & 1,156,000,000.00 \\ DstLoad & 1,017,794 & 222,130.87 & 7,796,189.49 & 0 & 688,000,000.00 \\ Load & 1,017,794 & 15,932,980.52 & 83,717,629.02 & 0 & 1,184,000,000.00 \\ SrcRate & 1,017,794 & 31,092.80 & 166,016.73 & 0 & 1,000,000.00 \\ DstRate & 1,017,794 & 415.16 & 15,458.57 & 0 & 1,000,000.00 \\ Rate & 1,017,794 & 31,539.27 & 166,697.32 & 0 & 3,000,000.00 \\ SrcLoss & 1,017,794 & 2.29 & 26.48 & 0 & 2105.00 \\ DstLoss & 1,017,794 & 2.55 & 51.79 & 0 & 5008.00 \\ Loss & 1,017,794 & 7.55 & 274.31 & 0 & 2,765,721.00 \\ pLoss & 1,017,794 & 20.14 & 8.08 & 0 & 60.00 \\ SrcJitter & 1,017,794 & 469.68 & 467.45 & 0 & 47,216.66 \\ DstJitter & 1,017,794 & 13.88 & 139.15 & 0 & 36,793.16 \\ StIntPkt & 1,017,794 & 82.53 & 558.58 & 0 & 9999.34 \\ DIntPkt & 1,017,794 & 8.29 & 70.96 & 0 & 9023.43 \\ Proto & 1,017,794 & 95.11 & 1620.82 & 0 & 35,020.00 \\ Dur & 1,017,794 & 0.55 & 326.62 & 0 & 329,590.91 \\ TcpRtt & 1,017,794 & 0.00 & 0.05 & 0 & 3.04 \\ IdleTime & 1,017,794 & 1,548,269,699.62 & 29,485,577.59 & 0 & 1,548,888,448.00 \\ Sum & 1,017,794 & 0.20 & 0.80 & 0 & 5.10 \\ Min & 1,017,794 & 0.20 & 0.80 & 0 & 5.10 \\ Max & 1,017,794 & 0.20 & 0.80 & 0 & 5.10 \\ sDSb & 1,017,794 & 0.00 & 0.18 & 0 & 51.00 \\ sTrl & 1,017,794 & 128.96 & 24.64 & 0 & 255.00 \\ dTrl & 1,017,794 & 58.28 & 18.65 & 0 & 128.00 \\ SAppBytes & 1,017,794 & 219.87 & 2853.92 & 0 & 99,793.00 \\ DApApBytes & 1,017,794 & 6738.53 & 727,317.25 & 0 & 81,823,144.00 \\ TotAppByte & 1,017,794 & 674,045.81 & 42,012,963.44 & 0 & 4,293,700.396.00 \\ SynAck & 1,017,794 & 0.00 & 0.05 & 0 & 3.04 \\ RunTime & 1,017,794 & 0.20 & 0.80 & 0 & 5.10 \\ sTos & 1,017,794 & 0.01 & 0.73 & 0 & 207.00 \\ SrcJitAct & 1,017,794 & 61.89 & 414.07 & 0 & 4999.44 \\ DstJitAct & 1,017,794 & 0.27 & 4.98 & 0 & 769.52 \\ Target & 1,017,794 & 0.07 & 0.26 & 0 & 1.00 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Statistical analysis of the WUSTL-IIoT-2021 dataset. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Class** & **Number of Samples** & **Percentage (\%)** \\ \hline Normal & 1,107,448 & 92.72 \\ DoS & 87,016 & 7.28 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Number of samples in each class of WUSTL-IIoT-2021 dataset. class labels indicating the category of each data entry are numerically represented. In cases where class labels are initially in textual format, they are transformed into numerical equivalents. For instance, the Traffic_Type attribute in the dataset comprises textual categories such as normal, command injection, DoS, reconnaissance, and backdoor. Given that 92% of the dataset consists of normal traffic and 90% of the remaining attack traffic corresponds to DoS attacks, all other attack types were also categorized as DoS attacks. Since textual representations hinder computational efficiency, these labels were converted into numerical values.