## 3 Materials and Method
### Dataset Annotation and Preprocessing
#### 3.2.2 Dataset Preprocessing  
For the study of detecting network attack behaviors, data preprocessing is a crucial step that directly impacts the efficiency of model training and the final performance of the model. The purpose of data preprocessing is to convert raw data into formats more suitable for machine learning models while improving data quality and minimizing noise interference. Data cleaning primarily involves removing irrelevant, erroneous, or duplicatedata from the dataset. For example, server logs may contain a large amount of normal access records that are not helpful for attack behavior detection and need to be removed. For text data, preprocessing steps include tokenization and removal of stop words. Tokenization refers to the process of splitting continuous text strings into sequences of tokens, which is foundational for text processing. The removal of stop words eliminates common but meaningless words from the text, such as \"the\" and \"is\". The aim of these steps is to reduce data dimensionality and alleviate the burden on the model. Subsequently, the TF-IDF (Term Frequency-Inverse Document Frequency) technique is employed to convert text into vector form. TF-IDF is a statistical method used to evaluate the importance of a word to a document in a corpus. Term Frequency (TF) indicates the frequency of a word in a document, while Inverse Document Frequency (IDF) is a measure of the general importance of the term. The TF-IDF value can be calculated using the following formula:  
\[\text{TF-IDF}(t,d)=\text{TF}(t,d)\times\text{IDF}(t) \tag{8}\]  
where \(t\) is a term and \(d\) is a document.  
\[\text{TF}(t,d)=\frac{\text{Number of occurrences of term $t$ in document $d$}}{\text{Total number of terms in document $d$}} \tag{9}\]  
\[\text{IDF}(t)=\text{log}\frac{\text{Total number of documents in the corpus}}{\text{Number of documents containing term $t+1$}} \tag{10}\]  
By calculating TF-IDF values, text data can be converted into vector form, where each dimension represents the TF-IDF value of a term, providing input data for subsequent deep learning model training. Standardization is an essential step for numerical data such as financial transaction amounts and server access frequencies. The purpose of standardization is to transform numerical data of different scales into a uniform scale, making it more suitable for model processing. The standardization method used in this paper is Z-score standardization, with the formula as follows:  
\[Z=\frac{(X-\mu)}{\sigma} \tag{11}\]  
where \(X\) is the original data, \(\mu\) is the mean, \(\sigma\) is the standard deviation, and \(Z\) is the standardized data. This method adjusts the scale and distribution of the data, making it more suitable for processing by machine learning models. For categorical data such as transaction types and request methods, vectorization is necessary to convert the categorical data into numerical data recognizable by models. The method used in this paper is one-hot encoding, which converts each category value into a binary vector, with only one position in the vector having a value of 1 and the rest having values of 0. The vectorization process of one-hot encoding can be mathematically represented as  
\[\text{One-Hot}(x_{i})=[0,\dots,1,\dots,0], \tag{12}\]  
where \(x_{i}\) is the original categorical data and \(\text{One-Hot}(x_{i})\) is the vector after one-hot encoding, with the position of 1 indicating the category. After completing data preprocessing, it is necessary to divide the dataset into training, validation, and test sets. This step is taken to evaluate model performance and prevent model overfitting. Dataset division typically relies on random sampling methods to ensure consistency in data distribution.