## 3 Network Anomaly Detection
### Data Acquisition and Process
#### 3.1.2 Feature Library Construction Methodology  
Given the wealth of valid attributes within network data and the strong correlations amongst these features, optimal network traffic feature extraction cannot simply be realized based on coverage and information entropy. To satisfy the need for feature extraction that eliminates irrelevant and redundant features while completely reflecting network traffic characteristics, we build on business feature extraction based on information entropy screening. To facilitate more effective feature compression and selection, we chose to utilize the mutual information-based maximum relevance minimum redundancy (mRMR) coefficient algorithm.  
The mRMR coefficient algorithm addresses a type of feature selection problem. The core idea of the algorithm is to find a group of features within the original feature data that exhibit maximum correlation with the final output results, but minimum redundancy amongst each other. The information quantity indicates how much information a feature contains, while the redundancy quantity characterizes the interrelation between features. The ultimate output of the algorithm, the mRMR coefficient, is the difference between these two quantities. Thus, during the execution of the algorithm, the effective features of overall network traffic are taken as inputs. In each iteration, the algorithm calculates the information quantity, redundancy quantity, and mRMR coefficient for each feature based on mutual information metrics, ultimately yielding the mRMR coefficient for each network traffic feature.  
The features in the network data are denoted by \(\mathcal{F}_{Y}=\{f_{1},f_{2},\dots,\}\). The computation of the mRMR coefficient via this algorithm primarily involves three steps. First, calculate the information quantity. The feature data with more information reflect the overall business characteristics better than the feature data with less information. Therefore, by comparing the information size of different features, different business features can be further filtered. Denoted by \(I(f_{i};f_{n})\), the mutual information between the features \(f_{i}\) and \(f_{n}\), the information quantity can be expressed by  
\[E(\mathcal{F}_{Y},f_{n})=\frac{1}{\left|\mathcal{F}_{Y}\right|}\sum_{f_{i}\in \mathcal{F}_{Y}}I(f_{i};f_{n}). \tag{2}\]  
Furthermore, less redundancy among features indicates less correlation between data. The redundancy quantity is given by  
\[R(\mathcal{F}_{Y})=\frac{1}{\left|\mathcal{F}_{Y}\right|^{2}}\sum_{f_{i},f_{j} \in\mathcal{F}_{Y}}I\big{(}f_{i};f_{j}\big{)}. \tag{3}\]  
The mRMR coefficient can be expressed as  
\[r_{n}=E(\mathcal{F}_{Y},f_{n})-R(\mathcal{F}_{Y}). \tag{4}\]  
As per the aforementioned algorithm, the group of features selected according to the mRMR coefficient maintain high correlation with the original data, thus ensuring that the output low-dimensional features can fully represent overall network traffic characteristics. Simultaneously, due to the smaller redundancy and less correlation between output features, the algorithm effectively eliminates irrelevant and redundant features, further realizing efficient feature compression.