## 3 Materials and Methods
### Pre-Processing  
We used the representative KDDCup99 dataset [24], which is a stream-based dataset with additional information from packet-based data or host-based log files. These data are available in a total dataset volume and 10% data volume. They have 41 features with five distinct attack classes. The specific types of attacks they include are shown in Table 1.  
For data pre-processing, our input is the initial dataset, and we obtained numerical datasets that can be used directly for FS through pre-processing. The pre-processing of the dataset consists of two steps: the conversion of character-based features to numeric features (the next part we will refer to as the conversion), and numerical normalization. In the conversion part, we performed the following: convert all feature types (including normal) into numeric identifiers. \begin{table}
\begin{tabular}{c c} \hline \hline
**Attack Categories** & **Specific Attack Types** \\ \hline DoS & Back, land, Neptune, pod, smurf, teardrop \\ Probe & Ipswep, nmap, portswep, satan \\ R2L & ftp\_write, guess\_password, tmap, multihop, phf, \\  & spy, warezclient, warezmaster \\ U2R & buffer overflow, loadmodule, perl, rootkit \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Specific attack types in KDDCup99, corresponding to five attack classes. Figure 1: The overall framework of our model. The yellow parts are the two important components of our model, data pre-processing and multi-classification, respectively. The two components of data pre-processing are shown in blue, the process of multi-classification is shown in green boxes, and the arrows indicate the data flow direction. In the numerical normalization part, we first calculated the mean and mean absolute error for each attribute using the following formula:  
\[\overline{\mathrm{x}}_{\mathrm{k}}=\frac{1}{\mathrm{n}}\sum_{\mathrm{i=1}}^{ \mathrm{n}}x_{\mathrm{ik}} \tag{1}\]  
\[S_{\mathrm{k}}=\sqrt{\frac{1}{\mathrm{n}}\sum_{\mathrm{i=1}}^{\mathrm{n}}(x_{ \mathrm{ik}}-\overline{\mathrm{x}})^{2}} \tag{2}\]  
where \(x_{\mathrm{k}}\) denotes the mean value of the kth attribute, \(S_{\mathrm{k}}\) denotes the mean absolute error of the kth attribute, and \(x_{\mathrm{k}}\) denotes the kth attribute of the i-th record. Then, we apply the normalization metric to each data record:  
\[Z_{\mathrm{ik}}=\frac{x_{\mathrm{ik}}-\overline{\mathrm{x}}_{\mathrm{k}}}{S_{ \mathrm{k}}} \tag{3}\]  
where \(Z_{\mathrm{ik}}\) denotes the kth attribute value of the i-th data record after normalization. We then normalize each value to the interval \([0,1]\) as follows:  
\[x^{*}=\frac{x-x_{\mathrm{min}}}{x_{\mathrm{max}}-x_{\mathrm{min}}} \tag{4}\]  
where \(x_{\mathrm{max}}\) is the maximum value of the sample data, \(x_{\mathrm{min}}\) is the minimum value of the sample data, and x is the previously obtained data. In this way, the data pre-processing gives us a numerical, normalized dataset suitable for FS use. For feature selection, we used feature selection to obtain the feature set that can be used for classification. FS is the method of selecting unique features based on specific criteria in machine learning. For a dataset, three components do not contribute to feature selection, which we call noise. These noises are irrelevant, redundant, and noisy. We distinguish between these three types of noise by using Table 2 as follows. In feature selection, feature subsets are selected from the original feature set based on feature redundancy and relevance [25]. We considered GA-KNN as our algorithm. In machine learning, one of the uses of Genetic Algorithms is to obtain the correct number of variables to create predictive models. The use of GA for FS has been more widely discussed and researched [26; 27]. Feature selection techniques are used to accurately identify relevant subsets of features, reducing the number of dimensions to improve overall efficiency. Feature selection helps reduce the possibility of overfitting while reducing the effect of feature loss by focusing on certain features.