## 4 Proposed Approach
### Model Training  
For model training, we employ four classifiers: Logistic Regression, XGBoost (Extreme Gradient Boosting), CNNs (Convolutional Neural Networks), Random Forest, and K-Nearest Neighbors (KNNs). These models were selected for their diverse approaches to classification, allowing for a comprehensive evaluation of different methodologies in detecting malicious and non-malicious network traffic. XGBoost is a powerful and efficient supervised learning algorithm designed for both regression and classification tasks [50]. It operates based on the boosting technique, where numerous decision trees are built consecutively to improve predictive performance. Consider the dataset \(D=\{(x_{i},\,y_{i})\}_{i=1}^{n}\), in which \(x_{i}\) represents the input characteristics and \(y_{i}\) represents the associated labels. The anticipated value \(\hat{y}_{i}\) for the \(i\)th instance in XGBoost is given as follows:  
\[\hat{y}_{i}=\varnothing(x_{i}){\sum}_{k=1}^{k}(f_{k}(x_{i})) \tag{2}\]  
Here, \(K\) is the total number of trees, and \(f_{k}\) is the prediction from the \(k\)-th tree. \(\varnothing(x_{i})\) represents the aggregate of all individual tree predictions. This iterative training process optimizes performance by effectively minimizing errors, making XGBoost a robust tool for identifying complex patterns in network traffic data. Random Forest serves as another ensemble learning approach that constructs numerous decision trees during training and returns the mean prediction for regression tasks [51] or the class modes for classification tasks. Let \(T(x,\,\varnothing_{k})\) be the prediction given by the \(k\)-th tree. In classification, the predicted value \(\hat{y}_{i}\) for the Random Forest is represented as follows:  
\[\hat{y}_{i}=\frac{1}{K}{\sum}_{k=1}^{k}(T(x,\,\varnothing_{k\,i}) \tag{3}\]  
Here, where the characteristics of the \(k\)-th tree are denoted by \(\varnothing_{k}\) and the total number of trees is represented by \(K\). Another straightforward yet efficient classification method, the K-Nearest Neighbors (KNNs) algorithm identifies a new data point by looking at the most prevalent class among its closest neighbors in the training data [52]. After identifying the k data points closest to the new instance, the algorithm either computes an average value based on these neighbors or assigns the class label based on a majority vote. For an instance \(x\), the predicted class \(\hat{y}\) can be determined by:  
\[\hat{y}=argmax_{y_{j}}\sum_{i\in N_{k}(x)}I\big{(}y_{i}=y_{j}\big{)} \tag{4}\]  
Here, \(I\) is the indicator function, \(y_{i}\) is the class of its \(i\)-th neighbor, and \(N_{k}(x)\) represents the set of \(k\)-nearest neighbors to \(x\). Logistic regression is used to calculate the probability \(p\) of a binary outcome (e.g., 1 for \"success\" and 0 for \"failure\") based on input features [53]. Mathematically, this can be represented as follows:  
\[p=\frac{1}{1+e^{-(\beta_{0}+\sum_{i=1}^{n}\beta_{i}x_{i})}} \tag{5}\]  
where \(\beta_{0}+\sum_{i=1}^{n}\beta_{i}x_{i}\) is the linear combination of input features. The sigmoid function maps \(z\) to the probability \(p\) between 0 and 1. If \(p\geq 0.5\), it predicts Class 1; \(p<0.5\), predicts Class 0. For tabular data, Convolutional Neural Networks (CNNs) are adapted to detect patterns in structured datasets by applying filters (convolutions) to the input. While CNNs are typically used in image data, in tabular data, convolutions can be used to capture local dependencies or relationships between features. The filters slide over the data to learn feature interactions, and the network reduces the data dimensions using pooling layers before passing them through fully connected layers for final predictions [54].