## 3 ENN
### Architectures of Models
#### 3.3.1 Convolutional Neural Networks (CNNs)  
The proposed model architecture combines CNN and MLP to tackle both binary and multi-class classification tasks. It begins with an input layer that accepts sequential data formatted as a one-dimensional array. The first CNN block performs convolution operations with ReLU activation, followed by batch normalization, max pooling, and dropout to extract and regularize key features in the data for binary classification. For multi-class classification, the initial CNN block applies convolution operations, followed by batch normalization, an activation function, max pooling, and dropout to extract and regularize important features in the data. This sequence is repeated in subsequent CNN layers with varying kernel sizes and pool sizes, enabling the model to capture diverse patterns and relationships within the input data. The different kernel sizes allow the model to detect features at multiple scales along the sequence, while the varying pool sizes help in downsampling and reducing the sequence's spatial dimensions, enhancing the model's ability to generalize across different input features. After passing through the CNN layers, the output is flattened and processed through an MLP block designed for binary classification. This block comprises a dense layer with an activation function, followed by batch normalization and dropout, to enhance the model's capability to learn intricate patterns while minimizing overfitting. Similarly, for multi-classification tasks, the output is flattened and passed through an MLP block that includes a dense layer, batch normalization, activation function, and dropout, effectively strengthening the model's ability to represent complex features and reducing the risk of overfitting. The features extracted from both the CNN and MLP components are concatenated to form a unified feature set. The final output layer utilizes a sigmoid activation function for binary classification or a softmax activation function for multi-class classification, paired with binary cross-entropy or categorical cross-entropy loss functions, respectively, to tailor the model's optimization process for the specific classification objective. The model is trained using the Adam optimizer, ensuring efficient learning and convergence throughout the training process. The convolution operation within the CNN layers is fundamental for feature extraction, as it applies filters to the input data. This process involves sliding the convolution kernel over the input feature map and computing the dot product at each position, resulting in a new feature map. The mathematical expression for the convolution operation is represented in Equation (10) [50]. \[Z_{i,j}=\left(X*K\right)_{i,j}=\sum_{m}\sum_{n}Z_{i+m,j+n}k_{m,n} \tag{10}\]  
where \(Z\) denotes the output feature map and \(X\) represents the input feature map. The convolution kernel, denoted by \(K\), is applied during the convolution operation to convert the input features into the output features. \begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Type of Class**} & \begin{tabular}{c} **Number of Samples Before** \\ **Resampling (ENN)** \\ \end{tabular} & \begin{tabular}{c} **Number of Samples After** \\ **Resampling (ENN)** \\ \end{tabular} \\ \hline \hline \begin{tabular}{c} Infiltration \\ \end{tabular} & \(13\) & \(13\) \\ \hline \
\begin{tabular}{c} Web Attack—Sql Injection \\ \end{tabular} & \(31\),\(172\) & \(31\),\(172\) \\ \hline
\begin{tabular}{c} Heartbleed \\ \end{tabular} & \(31\),\(172\) & \(31\),\(172\) \\ \hline \hline \end{tabular}
\end{table} 
Table 11: _Cont._The ReLU activation function depicted in Equation (11) [51] is a straightforward yet effective non-linear transformation. It outputs zero for negative inputs, preserves positive values, helps address the vanishing gradient problem, and encourages sparse activations, all of which improve training efficiency and model performance.