 |
Normal activities dominate most network traffic data. Measuring the similarity between normal and botnet activities requires in-depth analysis to make the calculation results fair. For this purpose, several approaches to balance the proportion are implemented, namely: Random under-sampling, is a process to reduce the amount of normal traffic, by selecting randomly according to the amount of botnet traffic. Random over-sampling, increases the number of records from botnet traffic. Sampling network traffic records is done randomly from existing data. Over-sampling with a 0 value, adds the number of records from botnet traffic with a value of 0. Unique value selection, selects botnets and normal traffic unique values before the over-sampling or under-sampling technique
|
IEEE/ICACT20230225 Slide.14
[Big Slide]