# Feature-Selection-Based DDoS Attack Detection Using AI Algorithms
## 3 Methodology
### Data Preprocessing  
Data preparation is critical for machine learning performance. It converts raw data into useable formats, allowing for insights and forecasts. Addressing missing data is critical in the CICDDoS2019 dataset. Error detection and correction are critical, and deleting columns with large data gaps might improve model performance. The CICDDoS2019 dataset contains many properties (columns) with zero values, as we have discovered. Such as some columns (Unnamed: 0, Bwd PSH Flags, Fwd URG Flags, Bwd URG Flags, FIN Flag Count, PSH Flag Count, ECE Flag Count, Fwd Avg Bytes/Bulk, Fwd Avg Packets/Bulk, Fwd Avg Bulk Rate, Bwd Avg Bytes/Bulk, Bwd Avg Packets/Bulk, and Bwd Avg Bulk Rate) which were dropped because these columns contain zero values in most of the records. **Feature Engineering:** After choosing a dataset, the key question is how to organize the data according to machine learning models which we selected before. Having fewer features may lead to better data visualization, faster learning, more accuracy, and less overfitting, among other benefits. There are several options for feature selection, and the best ones are given below. We used filtering techniques that relied on correlation for the end outcome. **Filter Methods:** Based on statistical metrics (such as correlation and chi-squared), these strategies rank or score features independently of the machine learning algorithm. **Correlations:** The statistical relationship between two variables is measured through correlations. Negative correlation means one variable rises as the other declines, and positive correlation says both variables rise or fall together. Correlation coefficients like [PERSON]'s (linear) or [PERSON]'s (rank-based) are used to measure it. Strong connection is indicated by a coefficient close to +1 or -1; weak or no correlation is indicated by a value close to 0. Correlation highlights associations rather than implying causation. To analyze \begin{table}
\begin{tabular}{l l} \hline \hline
**Features** & **Descriptions** \\ \hline Active Mean & Duration of active network connections \\ SYN Flag Count & SYN flags in the TCP packets \\ Inbound & Distinguishing between normal and potentially malicious traffic \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _Cont._connections and forecast behavior, it is utilized in a variety of disciplines like economics, science, and data analysis. Almost three different approaches were used in our study to pick features. First, we utilized the scikit-learn library's \"SelectBest\" method. The purpose of this method is to automatically choose features according to defined standards, such as having to pick 10 features from the dataset. But the results fell short of our expectations. Next, we looked at univariate selection strategies, which are useful in locating characteristics that make a substantial contribution to the predictive ability of the model. Finally, we chose features that depend on one another using a correlation-based method, which greatly improved our model's accuracy. By quantifying the linear correlations between the variables, this strategy helped to clarify the links between the variables. However, it is crucial to remember that this method relies on linear interactions and may miss nonlinear relationships, scale inconsistencies, and connections between variables, all of which call for careful analysis. In Figure 2 the heat map depicts the correlations between several network traffic factors. Each square in this type of depiction represents the relationship between the x- and y-axis features. The color intensity and sign of the numbers indicate the correlation's strength and direction (red for positive and black for negative). For example, darker red squares indicate a stronger positive link, whereas darker black squares indicate a stronger negative correlation. Lighter squares or white indicate little to no connectivity. This graphic is widely used to quickly assess which pairs of attributes are most strongly associated.