# Deep Feature Fusion via Transfer Learning for Multi-Class Network Intrusion Detection
## 3 Data Processing and Preparation
Due to the insufficient representative samples for these rare classes, the model struggles to learn their distinguishing characteristics, which consequently impairs its generalization capability when encountering similar attack types in operational scenarios. Moreover, retaining these underrepresented classes introduces superfluous noise and exacerbates the imbalance in sample distribution, further hindering the learning process by compromising the model's ability to discern nuanced patterns within the dataset [27]. Therefore, to mitigate these challenges and focus on transfer learning performance, the following attack types were removed from the CIC-IDS2017 dataset: Bot, Web Attack Brute Force, Web Attack XSS, Infiltration, Web Attack SQL Injection, and Heartbleed. Similarly, BruteForce-Web, BruteForce-XSS, and SQL Injection were excluded from the CIC-IDS2018 dataset. Application of Sampling Techniques to Mitigate Data Imbalance  
Following the removal of rare attack types, undersampling techniques were applied to adjust the number of samples per class, mitigating a data imbalance across attack types [28]. In multi-class classification models, an imbalanced number of samples across classes can negatively impact overall model training, and this imbalance can be mitigated by undersampling the majority-class data [29]. In this process, the data ratio for each attack type was adjusted to 1:1 relative to the minority classes, preventing overfitting to majority-class attack types. Integration of Similar Attack Types  
As some attack types share similar characteristics, they were grouped into the same category, as outlined in [30]. Attack types that were not removed but had relatively fewer data samples were merged based on their similarities. For example, in the CIC-IDS2017 dataset, DoS_Hulk, DoS_GoldenEye, DoS_slowloris, and DoS_Slowhttptest were integrated into \"DoS\", and in the CIC-IDS2018 dataset, each DoS attack type was combined into \"DoS\", while DDoS attack-HOIC, DDoS attacks-LOIC-HTTP, and DDoS attack-LOIC-UDP were merged into \"DDoS\". This process can help mitigate the data imbalance, ensuring the model learns effectively from minority-class attack types. Data Standardization (Standard Scaling)  
When features have different units, certain features may disproportionately influence model training. To prevent this, the standard scaling technique was applied [31]. Standardscaling transforms each feature to exhibit a mean (\(\mu\)) of 0 and a standard deviation (\(\sigma\)) of 1, following Equation (1). \[x^{\prime}=\frac{x-\mu}{\sigma}, \tag{1}\]  
where \(x^{\prime}\) is the standardized value, \(x\) is the original data, \(\mu\) is the mean of the data, and \(\sigma\) is the standard deviation. Through this transformation, all features are adjusted to a comparable scale, allowing the model to learn from the data more effectively. Thus, as illustrated in Figure 1, the data preprocessing process in this study comprises six sequential stages: removal of outliers, elimination of unnecessary features, removal of rare classes, application of sampling techniques, integration of similar classes, and standardization of data. This preprocessing mitigated the inherent data imbalance problem in network intrusion datasets, allowing the model to focus more on the transfer learning perspective and detect new attack types more accurately.