# Evaluating Ensemble Learning Mechanisms for Predicting Advanced Cyber Attacks
## 4 Implementation and Pre-Dataset Processing  
### Dataset  
The evaluation of the proposed models has been conducted using the UNSW-NB15 [10; 11; 12] dataset, which is widely recognized in the field of network intrusion detection. The UNSW-NB15 dataset was created from real traffic data captured in an Australian university network, providing a more realistic representation of network activity. This dataset includes various attack types, normal traffic, and encrypted traffic, making it a comprehensive resource for evaluating IDS performance. Nonetheless, some researchers criticize the UNSW-NB15 dataset for its skewed class distribution [31], which can lead to biased performance evaluations, especially when dealing with rare or novel attack types.  
While the aforementioned datasets have significantly contributed to the advancement of intrusion detection research, they all have their limitations that researchers should be mindful of [32]. To ensure robust and accurate evaluation of intrusion detection systems, it is crucial to select datasets that reflect the latest cyber-threat landscape, encompassing a diverse set of attack scenarios, and avoid biases in class distribution. Additionally, researchers should consider the specific requirements of their study and carefully validate the suitability of the chosen dataset for their research goals. By utilizing the UNSW-NB15 dataset, the experimental methodology aims to assess models' ability to accurately detect and classify different attacks based on real-world network traffic patterns. The inclusion of a wide range of attack types in the dataset ensures that the models are exposed to diverse and realistic attack scenarios, enabling a comprehensive evaluation of their performance in cyber-attack prediction. UNSW-NB15 is a comprehensive dataset commonly used to evaluate IDS models, created by the Cyber Range Lab of UNSW Canberra [10; 11; 12]. The dataset is a combination of modern real-world normal network traffic and simulated modern attack behaviors that reflect different security attack scenarios. A total of 2.5 million traffic records are stored in several files, and the ground truth table is given.  
The UNSW-NB15 dataset has been selected for its realistic and sophisticated attack scenarios, a broad feature set that can be adapted based on the model functionality, variety of attack types accompanied with their corresponding vectors, and enhanced performance.  
Figure 1: Research Methodology.  
Data records contain normal and malicious activities that have been extracted from three distinct virtual servers. Additionally, it contains 49 features that have been obtained from network packets using the Bro-IDS and Argus. Before using this dataset to develop classifier models, however, issues like overlap, extreme values and class imbalance need to be resolved. Authors in [33] have conducted an in-depth analysis of the UNSW-NB15 dataset compared to the KDD99, focusing on the relevance of the features to model performance. They have concluded that the accuracy of the model is influenced by a limited set of features. Every record in the UNSW-NB15 is classed as either normal or attacked, with the attack label additionally split into ten categories for further granularity. This allows the classification to be performed in binary or multiclass fashion.