10-02: Exercises

Question

You're given one raw network-connection record intended as a training example for an IDS classifier:

Field	Value
protocol_type	tcp
service	http
flag	SF
duration	2 (seconds)
src_bytes	1032
dst_bytes	54321
label	normal

Describe how each field would need to be transformed before this record could be fed into an SVM classifier, and why.

---

Solution

Per 10-04: Feature Engineering (NSL-KDD), an SVM (and most classical ML models) needs purely numeric input, and generally performs better when numeric features are on comparable scales. Going field by field:

protocol_type — categorical → needs encoding

tcp is a category, not a number, out of a small fixed set (tcp, udp, icmp, …). This needs one-hot encoding: a set of binary columns, one per possible protocol, with a 1 in the column matching this record's actual protocol and 0 elsewhere. (Label encoding — assigning tcp=0, udp=1, icmp=2 — would be a mistake here, since it would imply a false ordering/distance between categories that don't actually have one.)

service — categorical → needs encoding

Same situation as protocol_type: http is one of many possible service categories (http, ftp, smtp, dns, …). This also needs one-hot encoding for the same reason.

flag — categorical → needs encoding

SF (a TCP connection-status flag code) is again categorical, from a small fixed set of possible flag values. One-hot encoding again.

duration — numeric, but needs scaling

2 is already a number, so no encoding is needed — but it's on a very different scale than dst_bytes (54321). Left as-is, dst_bytes would dominate any distance-based calculation the SVM performs purely because its raw numbers are bigger, not because it's actually more important. This needs feature scaling (e.g., StandardScaler, which rescales each feature to have mean 0 and standard deviation 1).

src_bytes / dst_bytes — numeric, but needs scaling

Same reasoning as duration — already numeric, but needs scaling alongside every other numeric feature so no single feature dominates just because of its raw magnitude.

label — the target variable, needs binary encoding (not a feature)

normal is the value we're trying to predict, not an input feature. Per 10-04: Feature Engineering (NSL-KDD), this gets encoded as a binary target: 0 for normal, 1 for any attack category (or vice versa, as long as it's consistent).

---

Final Answer

Field	Transformation needed
protocol_type	One-hot encode (categorical)
service	One-hot encode (categorical)
flag	One-hot encode (categorical)
duration	Keep numeric, then scale (e.g., StandardScaler)
src_bytes	Keep numeric, then scale
dst_bytes	Keep numeric, then scale
label	Encode as the binary target (0 = normal, 1 = attack) — not an input feature

The general rule: categorical fields get one-hot encoded, numeric fields get scaled together, and the label is separated out and binary-encoded as the target the model learns to predict.