Dataset Year Source Traffic Type Attack Types Features Strengths Weaknesses Ethiopia Relevance
Verify dataset characteristics from original or authoritative sources.
Do not rely on secondary websites for exact dataset statistics where the original publication is available.
Important
If no suitable Ethiopian dataset is publicly available, explicitly state:
> The experimental results will demonstrate model performance on the selected dataset, not direct performance on Ethiopian network traffic. Ethiopian applicability will therefore be treated as a transferability and feasibility question rather than assumed as an experimental fact.
17. DATA PREPROCESSING
Develop a reproducible preprocessing pipeline.
Include:
1. Dataset inspection
2. Data cleaning
3. Missing-value treatment
4. Duplicate detection
5. Label normalization
6. Encoding
7. Feature scaling where appropriate
8. Feature selection
9. Class balancing
10. Train/validation/test separation
Explain how data leakage will be prevented.
Explain why class balancing is necessary and compare appropriate strategies where feasible.
18. MACHINE LEARNING MODEL SELECTION
Select 3–5 models based on:
Literature evidence
Dataset characteristics
Computational feasibility
Interpretability
Cybersecurity suitability
For each model discuss:
Principle of operation
Strengths
Weaknesses
Computational requirements
Expected suitability
A reasonable baseline may include:
1. Logistic Regression
2. Decision Tree
3. Random Forest
4. Support Vector Machine
5. XGBoost
However, do not assume these are automatically the best choices. Justify the final selection.
19. EXPERIMENTAL DESIGN
Design an experiment that another undergraduate researcher could reproduce.
Specify:
Hardware
Use realistic laptop/desktop specifications.
Software
Consider:
Python
Jupyter Notebook
pandas
NumPy
scikit-learn
matplotlib
seaborn, if appropriate
XGBoost, if selected
Training
Specify:
Training set
Validation strategy
Test set
Cross-validation
Hyperparameter tuning
Baseline comparison
Testing
Use an independent test set whenever possible.
Explicitly address data leakage.
20. CLASS IMBALANCE EXPERIMENT
This section directly addresses RQ2.
Design an experiment comparing model performance under different class-balance conditions where feasible.
Consider:
Original imbalanced dataset
Class weighting
Random undersampling
Oversampling
SMOTE, where appropriate
Compare:
Precision
Recall
F1-score
False-positive rate
PR-AUC
Explain the trade-offs between detecting more attacks and producing more false alarms.
Do not use resampling techniques incorrectly across train and test data.
21. FEATURE IMPORTANCE ANALYSIS
This section directly addresses RQ3.
Identify which features contribute most strongly to prediction.
Depending on the selected models, consider:
Feature importance
Permutation importance
Coefficients
Tree-based importance
SHAP, if technically feasible
Explain why identifying important features may improve:
Model interpretation
Computational efficiency
Deployment feasibility
Understanding of network behavior
Do not interpret feature importance as proof of causation.
22. MODEL EVALUATION
Use evaluation measures appropriate for cybersecurity.
Primary metrics:
Precision
Recall
F1-score
False-positive rate
Additional metrics:
Accuracy
ROC-AUC
PR-AUC
Confusion matrix
Training time
Prediction time
Memory/model size where feasible
Explain why accuracy alone can be misleading under class imbalance.
Present results using consistent test data and evaluation procedures.
23. STATISTICAL COMPARISON
Where appropriate, determine whether observed differences between models are statistically meaningful.
Consider appropriate statistical procedures rather than simply comparing percentages.
Explain:
Why statistical testing is required.
Which test is appropriate.
Assumptions of the test.
Significance level, such as α = 0.05.
Interpretation of p-values and effect sizes.
August 15, 2026 379 8
