## 4 Methodology
### Dataset Preprocessing
socket information can result in an overfitting issue because the model decision is biased to this information. During the analysis of CIC datasets, we found that 13 features contain zero value over all instances. These features are redundant as their value is constant for all traffic classes and are not useful to differentiate these classes. We also found that these datasets include a few missing (NaN) and infinity values. Missing and infinity values affect the ML model performance and predictive capacity [44]. Therefore, we clean the data by removing the instances that include missing or infinity values. The feature values in the CIC datasets include various numerical values, and training the model without scaling these values can result in classification errors and also causes the model to take more training time. We address this issue by implementing MinMaxScaler [45], a scaling techniques used in Python. This technique can normalize the data so that the minimum value of the feature becomes zero and the maximum becomes one. In Table 4, we present the distribution of attacks in CICDDoS2019 as an example of unbalanced CIC datasets. As can be seen, there is an extreme unbalancing between the different classes. The TFTP represents the largest number of instances, while the WebDDoS has a much smaller number of instances than the other types of attacks. Therefore, we drop the WebDDoS before resampling the dataset [46]. [PERSON] et al. [47] investigated the issue of improving classification performance on the imbalanced CICDDoS2019 dataset. They first carried out their classification experiment on the original imbalanced dataset. The result of this experiment returned low performance in the classification process. They then attempted to improve the performance by applying resampling techniques to balance the CICDDoS2019 dataset. The final results of this work showed improvement, though not significant, in the classification performance. Several studies, such as [46; 48; 49], referred to difficulty obtaining high performance from the classification of the imbalanced CICDDoS2019 dataset, and they addressed this issue by balancing the data and then using additional strategies to improve the performance. Furthermore, [PERSON] et al. [46] formalized the concept of imbalance through the Pielou index \(J\) as a metric of balancing. The values of \(J\) are located between 0 and 1, where 0 indicates the largest unbalance, and 1 represents the largest balance. The value of \(J\) for the imbalanced CICDDoS2019 dataset was 0.765. One approach to address the issue of class unbalance in the used dataset is to randomly resample the training dataset using undersampling or oversampling methods [50]. Undersampling works by removing the instances from the majority class, while oversampling works by duplicating the instances from the minority class. Due to hardware limitations and to efficiently allocate the data in the available memory, we apply the resampling process by undersampling all attack classes in the CIC datasets. We conduct the undersampling process by employing the built-in Python module 'RandomUnderSampler' [51], which involves randomly selecting examples from the majority class to delete from the training dataset. The instances of CIC datasets after performing the preprocessing become \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**CICIDS2017**} & \multirow{2}{*}{**CSECICIDS2018**} & \multicolumn{3}{c}{**CICDDoS2019**} \\ \cline{3-5}  & & **TCP** & **UDP** & **TCP/UDP** \\ \hline GoldenEye & GoldenEye & MSSQL & NTP & DNS \\ \hline Hulk & Hulk & SSDP & TFTP & LDAP \\ \hline Slowhttp & Slowhttp & SYN & UDP & NetBIOS \\ \hline Slowloris & Slowloris & - & UDP-Lag & SNMP \\ \hline - & HOIC & - & - & WebDDoS \\ \hline - & LOIChttp & - & - & - \\ \hline \hline \end{tabular}
\end{table} 
Table 3: DDoS attacks in CIC datasets. 5499, 10,990, and 55,765 for each class in CICIDS2017, CSECICIDS2018, and CICDDoS2019, respectively. Each of these instances is a vector with 67 features ready to be classified.