# Deep Feature Fusion via Transfer Learning for Multi-Class Network Intrusion Detection
## 3 Data Processing and Preparation  
This research utilizes the CIC-IDS2017 and CSE-CIC-IDS2018 datasets [21; 22] for training and evaluating a network attack-type classification model that implements transfer learning techniques between source and target domains. These datasets, developed by the Canadian Institute for Cybersecurity (CIC), serve as standard benchmarks in network intrusion detection system (NIDS) research and provide comprehensive resources for training machine learning and deep learning models due to their inclusion of both normal network traffic and diverse cyberattack data. The CIC-IDS2017 dataset, collected in 2017, comprises network traffic data encompassing normal traffic alongside 14 distinct attack types, such as DDoS, Brute Force, Botnet,and various Web Attacks. The CIC-IDS2018 dataset represents an enhanced version of the previous dataset, incorporating continuous network activity monitoring and expanding coverage to include IoT-based attacks as well as the latest web-based attacks, such as SQL Injection and cross-site scripting (XSS). Significantly, both datasets share 80 identical features, providing useful attributes for network traffic analysis, including flow duration metrics, interpacket time intervals, and TCP flag information. A notable characteristic of both datasets is the predominance of normal traffic relative to attack traffic, with certain attack types represented by comparatively few samples. This class imbalance presents a critical challenge for model training, potentially inducing bias toward majority classes and compromising detection performance for underrepresented attack categories, thus presenting a significant obstacle to effective supervised learning [23]. Consequently, this study focuses on evaluating transfer learning techniques in network intrusion detection through the implementation of preprocessing methodologies that strategically integrate similar attack types and establish balanced class distributions to mitigate these inherent dataset limitations. This study employs the CIC-IDS2017 and CIC-IDS2018 datasets as training data for the network intrusion detection model. These datasets include various cyberattack typologies and undergo systematic preprocessing to enhance model training effectiveness by integrating similar attack types and balancing data across classes. Figure 1 illustrates the key steps of this preprocessing process. Figure 1: NIDS data preprocessing process for training the proposed model. Data Loading and Outlier Removal  
The first preprocessing step involves data loading and outlier elimination. After importing the CIC-IDS2017 and CIC-IDS2018 datasets, any outliers present in the original data are processed. Outliers can lead to calculation errors and cause distorted results during model training [24]. Therefore, \(\text{Inf }(\infty)\) and \(-\text{Inf }(-\infty)\) values are replaced with NaN, and all missing values (NaN) are removed to perform data cleaning. Removal of Features That Can Negatively Impact Model Training  
After removing outliers, certain features within the dataset were removed. The dataset includes features that may not be useful for model training or may not be measured in real-world environments. For example, features such as Protocol, Destination Port (Dst Port), and Timestamp may be included in the dataset creation process but may not be measured in actual attack detection environments and can cause the model to overfit. Therefore, these features are removed to enhance the model's generalization capability [25]. Rare Class Removal  
Next, after eliminating irrelevant features, attack types with extremely small sample sizes were excluded to address data imbalance issues. Certain attack categories containing minimal instances in the dataset tend to function as noise during training [26].