# GlassBoost: A Lightweight and Explainable Classification Framework for Tabular Datasets
## 4 Proposed Method
### Data Preprocessing (Step 1)  
Data preprocessing is crucial in machine learning, as it directly impacts the performance and accuracy of trained models. Real-world datasets often contain missing values or values that fall outside the expected range. In this research, samples with such features were identified and discarded. Although imputation, the filling in of missing values, could have been employed, it was not implemented. This decision was based on the dataset's abundance of complete, reliable samples and because imputed values may inaccurately reflect the inherent relationships in the data. In addition, the number of samples with missing or out-of-range values was insignificant compared to the overall dataset size.  
Following this, the variance of each feature was computed, and features with zero variance were identified. Zero-variance features, characterised by identical values across all data points, provide no useful information for distinguishing between different classes. In tree-based machine learning algorithms, these features do not contribute to data partitioning, resulting in unnecessary computational effort and potentially slowing down the training process. Additionally, they can distort the perceived importance of other features. For these reasons, zero-variance features, as listed below, were removed from the dataset.  
* Bwd PSH Flags;
* Fwd URG Flags;
* Bwd URG Flags;
* CWE Flag Count;
* Fwd Avg Bytes/Bulk;
* Fwd Avg Packets/Bulk;  
\begin{table}
\begin{tabular}{l c c} \hline \hline
**Category** & **Number of Samples** & **Anomaly** \\ \hline BENIGN & 440,031 & 0 \\ DoS Hulk & 231,073 & 1 \\ DoS GoldenEye & 10,293 & 1 \\ DoS Slowloris & 5796 & 1 \\ DoS Slowhttptest & 5499 & 1 \\ Heartbleed & 11 & 1 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Class distribution of the dataset with malicious attacks assigned as anomalies.  
* _Fwd Avg Bulk Rate;_
* _Bwd Avg Bytes/Bulk;_
* _Bwd Avg Packets/Bulk;_
* _Bwd Avg Bulk Rate._  
Decision tree-based algorithms operate by selecting the most informative features for splitting at each node to maximise information gain. When two or more features are identical, they provide redundant information, causing the algorithm to select features arbitrarily. This redundancy increases computational overhead without contributing to model performance. Therefore, the next preprocessing step focuses on detecting and removing duplicated features. Table 2 illustrates the identical features found within the dataset. Each row in the table represents a pair of duplicate features. For each pair, only the feature on the left-hand side of the table is retained.  
The next step in the preprocessing process involves normalising the features by subtracting their mean value and dividing by their standard deviation. Figure 1 shows the covariance matrix of the features after the preprocessing step. As seen in Figure 1, all diagonal elements of the covariance matrix represent large values that indicate the successful removal of zero variance features. Further analysis reveals similar patterns across certain features, indicating strong covariance. However, upon closer inspection, we observe that despite their high correlation, these features still exhibit subtle differences that could be critical for classification.  
We refrain from further elimination at this stage to ensure that no potentially valuable discriminative information is lost. Instead, we allow the next step of the proposed approach to identify the most relevant features for the learning process.  
As the final step of the preprocessing, we modify the labels. As shown in Table 1, the dataset contains six classes of samples. The class BENIGN represents normal activities, while the other five classes correspond to different types of malicious attacks. Since we aim to design an intrusion detection system, we modify the labels to fit an anomaly detection framework. Specifically, as shown in Table 1, we assign label 0 to BENIGN samples and label 1 to all other samples.