## 3 Methodology
### Data Preprocessing
#### 3.2.2 Removing Outliers Using LOF  
The LOF method was utilized to identify and remove outliers from the dataset, thereby improving the quality of the data used for model training. LOF works by detecting data points with significantly lower density than their surrounding neighbors, making it particularly effective for datasets with uneven density distributions. In this implementation, the LOF algorithm was set with n_neighbors at 20 and a contamination rate of 0.05, suggesting that approximately 5% of the data was expected to be outliers. Once the LOF model was fitted, each sample was categorized as either an outlier (labeled \(-1\)) or an inlier (labeled 1). Only the inliers were retained for further processing, ensuring the removal of extreme values that could have negatively impacted model performance. It is important to note that the LOF method is designed to remove data points that deviate significantly from the overall distribution of the dataset and does not target or remove cases of anomalous behavior such as attacks, which exhibit identifiable characteristics distinct from normal traffic. Therefore, removing outliers does not interfere with the detection of anomalous behavior but ensures the dataset is free from extreme, irrelevant values that could distort model training. This outlier detection process was applied to the features of the dataset, excluding the labels. The resulting dataset, now free of outliers, was used in the subsequent stages of model training and evaluation, enhancing the performance and robustness of the classification models for both binary and multi-class tasks without compromising the detection of anomalous behavior. The LOF score, as shown in Equation (1) [39], was used to identify outliers by comparing the local density of a data point to the densities of its neighbors. The score was calculated by measuring the local reachability density (\(\mathrm{Ird}\)) of a point \(X\) and its neighbors. A point with a significantly lower LOF score than its neighbors is considered an outlier, indicating that it resides in a region of much lower density. This method helped to isolate data points that deviated from the overall distribution of the dataset, making it useful for outlier detection. \[LOF(K.X)=\frac{\mathrm{Ird}(X)}{\frac{1}{K}\sum_{i\in N_{K}(X)}\mathrm{Ird}(i)} \tag{1}\]  
where \(\mathrm{LOF}(K.X)\) is the local outlier factor for the point, \(\mathrm{Ird}(X)\) represents the local reachability density of the point \(X\), and \(N_{K}(X)\) denotes the set of k-nearest neighbors to point \(X\). The LOF score compares the local density of point \(X\) to the density of its neighbors, helping to identify outliers by highlighting points that are less densely populated than their neighbors. The sample distribution of the CICIDS2017 dataset for binary classification, before and after the application of the LOF method, is detailed in Table 4. The LOF technique significantly impacted the dataset, particularly by reducing the number of samples in both the Normal and Attack classes. Specifically, the Normal class, which initially contained 99,000 samples, was reduced to 93,053 samples following outlier removal. Similarly, the Attack class, which had 76,368 samples before applying LOF, saw a reduction to 73,546 samples after the outlier removal process. Overall, the application of LOF resulted in a cleaner dataset, removing extreme values and enhancing the balance and reliability of the data for the binary classification model. The sample distribution of the CICIDS2017 dataset for multi-class classification before and after the application of the LOF method is shown in Table 5. The LOF method had a noticeable effect on the dataset, particularly in reducing the number of samples in various classes. For instance, the PortScan class, initially containing 12,000 samples, was reduced to 11,892 samples after outlier removal. Similarly, the DDoS class decreased from 14,000 to 13,544, while the number of samples in the DoS Hulk class dropped from 39,000 to 36,640.