## 3 Proposed Approach
### Data Preprocessing
#### Normalization  
Data scaling, a crucial preprocessing step in machine and deep learning, involves adjusting numerical values to a specific range, thereby enhancing the efficiency and effectiveness of model. This standardization process is applied across all columns, ensuring consistent data representation. Among various normalization techniques, the MinMaxScaler, a widely used tool in the scikit-learn library, stands out as the most effective for our study. The normalization formula, as depicted in Equation (1) [80], calculates each value by subtracting the minimum value in the column and dividing by the range (the difference between the maximum and minimum values). In this context, \(X\) represents the original values, \(\min(X)\) is the minimum value in the column, and \(\max(X)\) is the maximum value in the column. After evaluating multiple normalization methods, MinMaxScaler was chosen for its superior performance. This normalization technique was applied to the  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Selected Features** & **Selected Features** & **Selected Features** & **Selected Features** \\ \hline MAX\_TTL & TCP\_WIN\_MAX\_IN & NUM\_PKTS\_128\_TO\_256\_BYTES & SRC\_TO\_DST\_AVG\_THROUGHPUT \\ \hline MIN\_IP\_PKT\_LEN & OUT\_PKTS & KMP\_TYPE & L7\_PROTO \\ \hline SERVER\_TCP\_FLAGS & DNS\_QUERY\_TYPE & FTP\_COMMAND\_RET\_CODE & DST\_TO\_SRC\_SECOND\_BYTES \\ \hline NUM\_PKTS\_UP\_TO\_128\_BYTES & FLOW\_DURTATION\_MILISECONDS & NUM\_PKTS\_26\_TO\_512\_BYTES & DNS\_TTL\_ANSWER \\ \hline L4\_DST\_PORT & NUM\_PKTS\_512\_TO\_1024\_BYTES & DNS\_QUERY\_ID & \\ \hline MAX\_IP\_PKT\_LEN & PROTOCOL & SHORTEST\_FLOW\_PKT & \\ \hline DST\_TO\_SRC\_AVG\_THROUGHPUT & RETRANSMIT\_ED\_IN\_PKTS & RETRANSMIT\_ED\_IN\_BYTES \\ \hline \hline \end{tabular}
\end{table}
Table 8: Selected features of NF-UNSW-NB15-v2 dataset in binary classification using correlation technique.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Selected Features** & **Selected Features** & **Selected Features** & **Selected Features** \\ \hline MIN\_TTL & PROTOCOL & NUM\_PKTS\_128\_TO\_256\_BYTES & DNS\_QUERY\_ID \\ \hline MIN\_IP\_PKT\_LEN & TCP\_WIN\_MAX\_IN & NUM\_PKTS\_512\_TO\_1024\_BYTES & L4\_SRC\_PORT \\ \hline SERVER\_TCP\_FLAGS & DST\_TO\_SRC\_AVG\_THROUGHPUT & TCP\_WIN\_MAX\_OUT & L7\_PROTO \\ \hline NUM\_PKTS\_UP\_TO\_128\_BYTES & OUT\_PKTS & NUM\_PKTS\_256\_TO\_512\_BYTES & DST\_TO\_SRC\_SECOND\_BYTES \\ \hline LONGEST\_FLOW\_PKT & FTP\_COMMAND\_RET\_CODE & SRC\_TO\_DST\_AVG\_THROUGHPUT & DNS\_TTL\_ANSWER \\ \hline L4\_DST\_PORT & SHORTEST\_FLOW\_PKT & DURATION\_IN & RETRANSMIT\_ED\_IN\_BYTES \\ \hline DNS\_QUERY\_TYPE & RETRANSMIT\_ED\_IN\_PKTS & ICMP\_TYPE & \\ \hline \hline \end{tabular}
\end{table}
Table 9: Selected features of NF-UNSW-NB15-v2 dataset in multi-class classification using correlation technique.  
selected features in the dataset, ensuring consistent scaling for both binary and multi-class classification tasks.  
\[X(scaled)=\frac{X-min(x)}{max(x)-min(x)} \tag{1}\]  
The testing file was employed for evaluating the NF-UNSW-NB15-v2 dataset, while the complete training file was used for training in the initial approach.