# Deep-Learning-Based Approach to Detect ICMPv6 Flooding DDoS Attacks on IPv6 Networks
## 5 Experimental Results
### The Result of the Feature Selection Phase  
Training the detection model using qualified features will positively impact the detection model. However, the used dataset consists of non-significant features that degrade the classifier's performance. These features are the time, source IP, destination IP, protocol, MAC source address, MAC destination address, source port, and destination port. For the time feature, the classifiers (i.e., RNN and LSTM) consider the time interval feature during the training process to indicate attacks. For example, the packets received within these time intervals are flagged as attacks; otherwise, they are normal. As a result, in the case of online detection, attack packets that arrive later will be classified as normal because their times are outside of the attack's training time intervals. Other features, such as source and destination IP, protocol, and MAC source and destination addresses, have the same effects as time values because they can identify attack packets during training but fail to detect them during testing. For example, if a source IP address does not exist in the training model, it will be classified as an attack. Furthermore, several existing IDS [12; 26] use port numbers as a feature to differentiate attack and normal ICMPv6 packets in the detection model construction. However, the port number is not used by ICMPv6 since it is a network layer protocol. According to the OSI model, port numbers are only applicable for transport layer protocols. Therefore, the inclusion of source and destination ports as features is useless and will result in low detection accuracy. Other than the source and destination ports, the time, source and destination IPs, the protocol, and MAC source and destination addresses features are also eliminated from the dataset. As a result, our dataset comprises 10 features: ICMPv6 type, IPv6 next header, length, RA MTU, RA router lifetime, RA prefix, RA flag, NA flags, NS target, and MLD flag, which are then fed into the IGR and chi-square functions. Table 4 displays the IGR and chi-square scores for each feature. Let \(th1=0.1\) and \(th2=1\); if feature score (IGR) \(\geq th1\) or feature score (chi-square) \(\geq th2\), the feature is selected. Otherwise, the feature will be negated. The value of thresholds is determined experimentally and is based on the observation of datasets. Three features, RA MTU, RA prefix, and MLD flags, are dropped as their scores are lower than the predefined thresholds. Table 5 shows the selected features by IGR and chi-square after applying the thresholds. \begin{table}
\begin{tabular}{c c c c} \hline
**No.** & **Feature** & **Feature Score (IGR)** & **Feature Score (Chi-Square)** \\ \hline
1 & ICMPv6 type & 4.06843988 & 1.17426781 \\
2 & IPv6 next header & 1.51979191 & 3.72058524 \\
3 & Length & 4.46315199 & 11.2899829 \\
4 & RA MTU & 0.027046904 & 0.992166989 \\
5 & RA router lifetime & 0.139719657 & 2.1899984 \\
6 & RA prefix & 0.026007147 & 0.478028763 \\
7 & RA flag & 0.118992257 & 2.1899984 \\
8 & NA flags & 0.712575719 & 2.50574105 \\
9 & NS target & 1.6334663 & 13.8955392 \\
10 & MLD flags & 0.001439028 & 0.000998617 \\ \hline \end{tabular}
\end{table} 
Table 4: Scores of each feature using IGR and chi-square functions. Based on Table 5, \(IGR\)\((f^{\prime})=\{ICMPv6\)\(type\), \(1 Pv6\)\(next\)\(header\), \(Length\), \(NAflags\), \(NS\)\(target\), \(RA\)\(flag\), \(RA\)\(outer\)\(lifetime\)\(\}\) and \(CHI\)\((f^{\prime})=\{ICMPv6\)\(Type\), \(1 Pv6\)\(next\)\(header\), \(Length\), \(NA\)\(flags\), \(NS\)\(target\), \(RA\)\(flag\), \(RA\)\(outer\)\(lifetime\)\(\}\). We can notice that both IGR and chi-square selected the same features, which reflect the importance of the selected features and their contribution to the detection of ICMPv6 attack detection.