# A Novel Traffic Classification Approach by Employing Deep Learning on Software-Defined Networking
## 3 Materials and Methods
### Modify
#### 3.3.4 Feature Selection  
This stage aims to select the most relevant features of a dataset to train a DL model. This is done to improve the model's accuracy, reduce the data's dimensionality, and facilitate the interpretation of the results. To this end, a thorough data analysis and feature engineering techniques are applied. Initially, it is essential to understand the data and, from thatunderstanding, to infer the information that can be derived from them. As a result, we identified 12 features with constant values across all samples in the dataset: \"Fwd PSH Flags\", \"Fwd URG Flags\", \"CWE Flag Count\", \"ECE Flag Cnt\", \"Fwd Bpts/b Avg\", \"Fwd Pkts/b Avg\", \"Fwd Blk Rate Avg\", \"Bwd Bts/b Avg\", \"Bwd Pkts/b Avg\", \"Bwd Blk Rate Avg\", \"Init Fwd Win Byts\", and \"Fwd Seg Size Min \". Consequently, we discarded these features as they did not provide meaningful information for classifier training.  
In the second stage, feature engineering was performed, which involved the application of the mutual information function. This function calculates the mutual information between each feature and the target variable in a classification problem. The function is based on the concepts of entropy and information theory. It means that a feature with a high mutual information score with the target variable provides valuable information for the classification task [36]. Two libraries, SelectKBest and mutual_info_classif from Scikit-learn [37], were utilized to conduct this analysis. A threshold of 0.40 was considered for feature selection, focusing on selecting the best features contributing to the model's classification. The result of this process is depicted in Figure 2, with feature score values in descending order to visualize the most important features.  
The previous sections aimed to evaluate the impact of each feature on the multiclass classification results. Therefore, analyzing the information obtained from SDN controllers using northbound interfaces is necessary, focusing explicitly on the study of APIs provided by the Ryu controller. This analysis is crucial in feature selection because classifiers can be implemented at the application layer of the SDN architecture. Although more features can be obtained from the controller, these should be evaluated and compared with the mutual information analysis performed before making the final decision. As a final result, five relevant features were obtained, which were used to train different DL models. The final selection of features is presented in Table 5.  
Figure 2: Mutual information score.  
Table 6 shows the results of the descriptive statistics for the five selected features. This information provides a detailed view of the features of the standardized data. It is observed that measures of central tendency, such as the mean, are very close to zero for most of the features, suggesting a distribution centered around zero after standardization. Standard deviations close to one indicate similar dispersion across all features after standardization. Ranges and percentiles reveal variability in the data, with some features, such as \"Flow Duration\", showing a much more comprehensive range than others. In addition, the presence of high values in \"Flow Pkts/s\" and \"Bwd Pkts/s\" is noted, with their maximum values significantly higher than the (75.00%) percentiles; however, these values are expected, as these are values in milliseconds. Overall, these results provide an in-depth understanding of the distribution and variability of the features.