## 4 Proposed Approach
### Dataset Preprocessing  
Preprocessing the dataset is a crucial step in improving and optimizing model performance. The data were initially converted into Pandas data frames [48], enabling streamlined workflows for analysis and modeling. Duplicate records were eliminated to guarantee data integrity and uniqueness, while infinite and missing values were methodically handled to reduce mistakes and biases in later modeling phases. To guarantee interoperability with machine learning algorithms, categorical labels were transformed into numerical representations. Columns with missing data were removed to maintain uniformity and reduce unnecessary complexity in the dataset. Data normalization was applied to enhance numerical consistency, improve model stability, and accelerate convergence by scaling features to a similar range. Features with zero value were eliminated, reducing the attribute count from 46 to 40, thereby focusing on the most important variables to improve model performance.  
A thorough explanation of the retained features is given in Table 1. By ensuring the dataset is clean, consistent, and optimized, this thorough preprocessing approach yields model results that are more accurate and reliable.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature Num.** & **Feature** & **Description** \\ \hline
0. & flow\_duration & Time between the first and the last packet \\
1. & Header\_Length & Header length \\
2. & Protocol type & TCP, IP, UDP, ICMP, IGMP, Unknown (Integers) \\
3. & Duration & Time to live (ttl) \\
4. & Rate & Pace at which packets are transmitted within a flow \\
5. & Srate & Rate at which packets are sent out within a flow \\
6. & fin\_flag\_number & Value of fin flag \\
7. & syn\_flag\_number & Value of syn flag \\
8. & rs\_flag\_number & Value of rst flag \\
9. & psh\_flag\_number & Value of psh flag \\
10. & ac\_flag\_number & Value of ac\_flag \\
11. & ac\_count & Quantity of packets with ac\_count in a network flow. \\
12. & syn\_count & Count of packets in the same flow with syn flag set \\
13. & fin\_count & Count of packets with the FIN flag in a network flow \\
14. & urg\_count & Quantity of packets with urg flag in a network flow \\
15. & rs\_count & Count of packets where the RST flag is enabled \\
16. & HTTP & Identifying if HTTP is the application layer protocol \\
17. & HTTPS & Identifying if HTTPS is the application layer protocol \\
18. & DNS & Identifying if DNS is the application layer protocol \\
19. & SSH & Identifying if SRI is the application layer protocol \\
20. & TCP & Identifying if TCP is the transport layer protocol \\
21. & UDP & Identifying if UDP is the transport layer protocol \\
22. & ARP & Identifying if ARP is the link layer protocol \\
23. & ICMP & Identifying if ICMP is the network layer protocol \\
24. & IPv & Identifying if IP is the network layer protocol \\
25. & LLC & Identifying if LLC is the link layer protocol \\
26. & Tot sum & Total packets in a flow \\
27. & Min & Min packet length \\
28. & Max & Max packet length \\
29. & AVG & Avg. packet length \\
30. & Std & Deviation from the mean of packet length within a flow \\
31. & Tot size & Packet’s length \\
32. & IAT & Time difference between the consecutive packets \\
33. & Number & Count of packets \\
34. & Magnitude & Square root of the total average packet lengths inside the flow, \\  & & including incoming and outgoing \\
35. & Radius & Square root of the total variation in the inbound and outgoing \\  & & packet lengths throughout the flow \\
36. & Covariance & Connection between the outgoing and incoming packet lengths \\
37. & Variance & Disparity in packet lengths between incoming and outgoing \\
38. & Weight & Ratio of incoming packets to outgoing packets within a flow \\
39. & DHCP & Identifying if DHCP is the application layer protocol \\ \hline \hline \end{tabular}
\end{table}
Table 1: Description of features in the CICIoT dataset.