# ResADM: A Transfer-Learning-Based Attack Detection Method for Cyber-Physical Systems
## 4 Experiment and Analysis
### Experimental Setup  
The experimental dataset was constructed using the CICIDS2017 dataset, which was a standard dataset for network traffic anomaly detection. The training process of ResADM is shown in Algorithm 1..  
The CICIDS2017 dataset needed to be cleaned according to the prescribed model design. Firstly, identify and replace any illegal characters found in the \"Label\" column in the dataset. Next, delete column 55 (Fwd Header Length) that duplicated column 34 (Fwd Header Length). Furthermore, discard rows where the values in columns 31 (Bwd PSH Flag), 33 (Bwd URG Flags), 56 (Fwd Avg Bytes/Bulk), 57 (Fwd Avg Packets/Bulk), 58 (Fwd Avg Bulk Rate), 59 (Bwd Avg Bytes/Bulk), 60 (Bwd Avg Packets/Bulk), and 61 (Bwd Avg Bulk Rate) were all equal to zero. In column 14 (Flow Bytes/s), there were 1358 instances of \"NaN\" and 1509 instances of \"Inf\". Similarly, column 15 (Flow Packets/s) contained 2867 instances of \"Inf\". To rectify these invalid values, calculate the column mean and substitute these values accordingly.  
Once the dataset was cleaned, a purposive sampling of network attack samples could be performed. To begin, randomly select 10,000 benign flows labeled as \"BENIGN\" from the file \"Monday-WorkingHours\". Extract 5000 instances of brute-force attacks labeled as \"FTP-Patator\" and another 5000 instances labeled as \"SSH-Patator\" from the file \"Tuesday-WorkingHours\". Merge these samples to form a set of 10,000 attack samples labeled as \"Patator\". Similarly, sample 10,000 instances of denial-of-service attacks labeled as \"DoS\" from the file \"Wednesday-workingHours\". Lastly, extract 10,000 instances of distributed denial-of-service attacks labeled as \"DDoS\" from the file \"Friday-WorkingHours-Afternoon-DDoS\". These steps result in a dataset containing 40,000 network flow samples, each with 78 features and 1 label. Randomly split the dataset into an 80% training set and a 20% test set. The distribution of each class within the divided dataset can be found in Table 2.  
The training set had to be passed to the attack-feature-selection layer for feature-importance analysis using the LightGBM model. The feature importance was calculated in the multi-classification process of traffic samples, and the features were ordered accordingly. Select the top \(k\) features with the highest importance for retraining the baseline multi-classification model. Gradually increase the value of \(k\) until it reaches 32, which maximizes the accuracy of the retrained baseline model. Remove the remaining features and keep the selected 32 features, as shown in Figure 4.  
To visualize the correlation between these 32 features and their sample labels, apply the K-means clustering algorithm to the network flow samples, as illustrated in Figure 5. The visualization demonstrated a clear distinction between the benign flow samples and the various categories of network attack flow samples, indicating that these 32-dimensional features effectively characterized normal traffic and attack traffic. Although DoS and DDoS attacks shared some behavioral features, there were still significant differences due to the presence of a large number of dispersed source addresses in the DDoS attacks. Therefore, the selected 32-dimensional features could be used as a feature set for training the backbone network.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline  & **BENIGN** & **DDoS** & **DoS** & **Patator** \\ \hline Training set & 7953 & 8000 & 8014 & 8033 \\ Testing set & 2047 & 2000 & 1986 & 1967 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Number of samples in each category of the dataset.