## 4 Training and Validating/Testing the Dataset
### Feature Extraction and Data Processing Description Using ML and DLMIDPSM Approach
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Number** & **Feature** & **Description** \\ \hline
1 & Fin flag number & Finish flag value \\ \hline
2 & Syn flag number & Synchronous flag value \\ \hline
3 & Psh flag number & Push flag value \\ \hline
4 & Ack flag number & Acknowledgment flag value \\ \hline
5 & Ece flag number & Explicit congestion notification echo value \\ \hline
6 & Car flag number & The congestion window reduced the number \\ \hline
7 & HTTP & Indicates if the application layer protocol is HTTP \\ \hline
8 & HTTPS & Indicates if the application layer is HTTPS \\ \hline
9 & DNS & Indicates if the application layer protocol uses DNS \\ \hline
10 & Telnet & Indicates if the application layer protocol uses Telnet \\ \hline
11 & SMTP & Indicates if the application layer protocol is SMTP \\ \hline
12 & SSH & Indicates if the application layer protocol is SSH \\ \hline
13 & IRC & Indicates if the application layer protocol is IRC \\ \hline
14 & TCP & Indicates if the application layer protocol is TCP \\ \hline
15 & UDP & Indicates if the application layer protocol is UDP \\ \hline
16 & DHCP & Indicates if the application layer protocol is HTTP \\ \hline
17 & ARP & Indicates if the application layer protocol is ARP \\ \hline
18 & ICMP & Indicates if the network layer protocol is ICMP \\ \hline
19 & IPv & Indicates if the network layer protocol is IP \\ \hline
20 & Flow duration & The duration of packet flow \\ \hline
21 & Header length & Header length in protocol header \\ \hline
22 & Protocol Type & \\ \hline
23 & Duration & Time-to-Live (TTL) \\ \hline
24 & Rate & Packet transmission rate in flow \\ \hline
25 & State & The outbound packet transmission rate in flow \\ \hline
26 & Date & The inbound packet transmission rate in flow \\ \hline
27 & Ack count & Packet amount with ack flag set in the same flow \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Intrusion attack features extracted in the IDPST network traffic. Figure 17: Data processing and converting from pcap to csv. We extracted these IoT network device features using state-of-the-art technology [62]. However, previous researchers have made an effort to validate these features. We can further extract and engineer many other features using the scripts generated in this research, including the raw network traffic generated, such as using the pcap files. Consequently, we grouped the values and counts of the intrusion attack features captured using a window size above 8 (i.e., Uploading_attack, Recon_PingSweep, Browser-Hijacking, XSS, Backdoor_Malware, Sqlinjection, CommandInjection, Dictionary Brute force, DDoS-SlowLownis, DDoS-HTTP_Flood, VulnerabilityScan, DoS_HTTP_Flood, ReconPortScan, ReconOSScan, Recon-HostDiscovery, DNS_Spoonfing, DDoS-ACK Fragmentation, DDoS-UDP_Fragmentation, MITM-ArpSpoofing, DDoS-ICMP_Fragmentation, Mirai-greip_flood, Mirai-greeth_flood, BenignTraffic, DoS-SYN_Flood, DoS-TCP_Flood, DoS-UDP_Flood, DDoS-SmanimousIP_Flood, DDoS-RSTFINFlood, DDoS-PSHACK_Flood, DDoS-SYN_Flood, DDoS-TCP_Flood, DDoS-UDP_Flood, DDoS-ICMP_flood), packets justifying the data size and any inconsistencies (e.g., DDoS, DoS CommandInjection), then determined their mean values, variances and covariances, and other features, including the mean (AVG), standard deviation (std), weight, max (maximum), and min (minimum), using Pandas [63] and NumPy [64]. These detected intrusion attack features are shown in Figure 18 below in histogram graphs. Consequently, we combined all the files and processed them into csv format using Pandas. Ultimately, the final csv datasets represented the combination of features of each data packet chunk.