## 3 Proposed Approach
### Data Preprocessing
#### 3.2.1 Removing Outliers Using Z-Score and Local Outlier Factor (LOF)
Prior to the application of z-score, the Benign class contained 96,432 samples, which decreased to 93,530 samples following outlier removal. Similar reductions were observed in other classes; for example, Exploits dropped from 18,804 to 17,492, and Fuzzers declined from 12,999 to 11,730. The Reconnaissance class saw a reduction from 7121 to 6881, while Generic samples decreased from 3810 to 3234. The DoS class also experienced a notable decrease, from 2677 to 2195 samples. In contrast, some smaller classes exhibited minimal changes, such as Shellcode, which went from 900 to 886, and Analysis, which decreased slightly from 490 to 330. The Worms class experienced a reduction from 104 to 92 samples. These modifications, achieved through z-score, helped maintain the integrity of the dataset by ensuring that extreme outliers were removed, thereby enhancing the robustness and accuracy of the subsequent classification models. \begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Class Type**} & **Number of Samples Before** & **Number of Samples After** \\  & **Z-Score** & **Z-Score** \\ \hline Benign & 96,432 & 93,530 \\ \hline Exploits & 18,804 & 17,492 \\ \hline Fuzzers & 12,999 & 11,730 \\ \hline Reconnaissance & 7121 & 6881 \\ \hline Generic & 3810 & 3234 \\ \hline DoS & 2677 & 2195 \\ \hline Shellcode & 900 & 886 \\ \hline Backdoor & 547 & 327 \\ \hline Analysis & 490 & 330 \\ \hline Worms & 104 & 92 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Sample distribution of NF-UNSW-NB15-v2 dataset in multi-class classification using z-score. \begin{table}
\begin{tabular}{c c c} \hline \hline \multicolumn{1}{c}{**Class Type**} & **Number of Samples Before LOF** & **Number of Samples After LOF** \\ \hline Benign & 93,653 & 85,680 \\ \hline Exploits & 17,576 & 14,969 \\ \hline Fuzzers & 11,695 & 10,116 \\ \hline Reconnaissance & 6883 & 6759 \\ \hline Generic & 3211 & 2668 \\ \hline DoS & 2180 & 1716 \\ \hline Shellcode & 886 & 605 \\ \hline Backdoor & 322 & 233 \\ \hline Analysis & 324 & 304 \\ \hline Worms & 89 & 87 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Sample distribution of NF-UNSW-NB15-v2 dataset in binary classification using LOF. The sample distribution of the NF-UNSW-NB15-v2 dataset in multi-class classification is detailed in Table 7, highlighting the impact of the LOF method on the dataset. Initially, the Benign class comprised 93,530 samples, which was reduced to 85,510 samples after outlier removal. Similarly, the Exploits class decreased from 17,492 to 14,933, while the Fuzzers class saw a decline from 11,730 to 10,131. The Reconnaissance class experienced a minor reduction from 6881 to 6774, and the Generic class dropped from 3234 to 2688 samples. The DoS class also faced a significant decrease, with numbers falling from 2195 to 1730. In the smaller classes, Shellcode decreased from 886 to 614, and Backdoor went from 327 to 243 samples. The Analysis class experienced a slight reduction from 330 to 316, while the Worms class saw minimal change, dropping from 92 to 88 samples. These adjustments, facilitated by the LOF method, contributed to a more balanced dataset by removing outliers, thereby improving the reliability and effectiveness of classification tasks.