# Image-Based Malicious Network Traffic Detection Framework: Data-Centric Approach
## 3 Proposed Detection Framework
### Data Preprocessing and Feature Engineering
#### 3.3.4 Feature Correlation Analysis  
CNN models process and analyze data by taking into account the spatial locality and relationships between adjacent pixels [79]. Consequently, the spatial arrangement of features when generating images from numeric feature vectors may influence CNN classification performance. Therefore, we conducted a correlation analysis to determine whether arranging highly correlated features adjacent to each other in the image would improve classification accuracy.  
\begin{table}
\begin{tabular}{c l c} \hline
**Rank** & **Feature Name** & **I.G Value** \\ \hline
22 & dst\_host\_rerror\_rate & 0.0767992 \\
23 & srv\_rerror\_rate & 0.0715524 \\
24 & srv\_count & 0.0687273 \\
25 & protocol\_type & 0.0581388 \\
26 & duration & 0.0342559 \\
27 & hot & 0.0148091 \\
28 & num\_compromised & 0.007111 \\
29 & wrong\_fragment & 0.0063851 \\
30 & num\_root & 0.0025104 \\
31 & num\_failed\_logins & 0.0023726 \\
32 & num\_access\_files & 0.0017842 \\
33 & num\_file\_creations & 0.0006682 \\
34 & su\_attempted & 0.0004711 \\
35 & root\_shell & 0.0001348 \\
36 & land & 0.000059 \\
37 & is\_host\_login & 0.0000511 \\
38 & is\_guest\_login & 0.0000106 \\
39 & num\_outbound\_cmds & 0 \\
40 & num\_shells & 0 \\
41 & urgent & 0 \\ \hline \end{tabular}
\end{table}
Table 4: _Cont._Specifically, to analyze the relationships between all feature vectors, we utilized the Pearson Correlation Coefficient (PCC) [80; 81; 82], calculating correlation coefficients through Equation (5) to generate a correlation matrix. Based on this matrix, we tested a correlation-based pixel mapping method, where features with high correlation values were positioned adjacently within the generated \(6\times 6\) pixel image.  
\[r_{xy}=\frac{\sum_{i=1}^{n}(x_{i}-\bar{x})(y_{i}-\bar{y})}{\sqrt{\sum_{i=1}^{n}( x_{i}-\bar{x})^{2}}\sqrt{\sum_{i=1}^{n}(y_{i}-\bar{y})^{2}}} \tag{5}\]  
where \(r_{xy}\) represents the PCC between features \(x\) and \(y\), \(x_{i}\) and \(y_{i}\) are the feature values of the \(i\)-th sample, \(\bar{x}\) and \(\bar{y}\) denote the mean values of each feature, and \(n\) is the number of samples.  
Figure 4 displays a heatmap matrix of the correlation analysis for the 41 features, while Table 5 shows the results of the calculated correlation coefficients. The correlation analysis revealed that the relationship between _serror_rate_ and _srv_serror_rate_ has the highest correlation coefficient (0.9915), while the correlation between count and _same_srv_rate_ is the lowest (\(-0.7336\)). As shown in Figure 4, features with high correlations are represented in deep red, while those with low correlations appear in deep blue. The diagonal elements showing self-correlation are represented by the deepest red color, indicating a perfect correlation of 1.0. Table 5 confirms these findings by listing the top five highest positive correlations and the five lowest negative correlations among the features. To examine the impact of feature correlation on classification performance, we conducted comparison experiments between correlation-based and sequential pixel mapping strategies, as described in Section 4.2. These experiments revealed negligible differences in CNN classification accuracy between these approaches. Therefore, to maintain simplicity and computational efficiency, we ultimately adopted sequential mapping of feature vectors into image pixels for the final dataset generation.