## 4 Experimental Simulations
### Experimental Results and Analysis
#### 4.3.1 Experiment on Feature Selection Analysis  
In order to verify the classification performance of the CNN-GRU algorithm proposed in this paper, the public dataset UNSW_NB15, NSL-KDD and CIC-IDS2017 were selected. This section focuses on the UNSW_NB15 dataset for detailed introduction. The detailed process of feature selection is mainly introduced for the RFP algorithm proposed in this paper.  
In this paper, the importance of each feature in the dataset UNSW_NB15 is first calculated by the Random Forest algorithm and ranked according to the degree of importance, as shown in Figure 8. From the figure, it can be seen that the importance degree of different features varies greatly, for example, the importance value of feature sbytes is 0.115, while the importance value of is_ftp_login and ct_ftp_cmd is zero. The importance metrics of all features are distributed between 0 and 0.12.  
Feature selection based on feature importance alone is a single reference criterion and the results obtained are not very convincing, so this paper combines feature importance and Pearson correlation analysis for feature selection. In order to visualize the correlation between features, a feature correlation diagram was created as shown in Figure 9. From the figure, the degree of correlation is clear between these 42-dimensional features. In order to further observe whether feature X and Y show correlation in the plane distribution, a correlation graph with feature X as the \(x\)-axis and feature Y as the \(y\)-axis is established. Due to the large number of data feature dimensions, this paper selects two types of features with correlation indices greater than or equal to 0.9 or less than or equal to \(-0.9\) for analysis and introduction, as shown in Table 7.  
Combining Figures 8 and 9 for feature selection. For features with strong linear correlation, the more important features are retained according to the degree of importance; for features with weak linear correlation, the importance index of the features is analyzed, and if it is lower than 0.001, they are eliminated; for features whose correlation index is not within the analysis interval, their importance index is also analyzed, and those features with an importance level below 0.0001 are excluded. Finally, the NSL-KDD dataset leaves 28-dimensional features, the UNSW_NB15 dataset leaves 28-dimensional features, and the CIC-IDS2017 dataset leaves 52 features.  
\begin{table}
\begin{tabular}{c c c c c c} \hline  & **Features** & & **Correlation Index** & & **Features** & **Correlation Index** \\ \hline spkts & sybytes & 0.964 & tcprtt & synack & 0.943 \\ spkts & sloss & 0.972 & tcprtt & ackdat & 0.920 \\ dpkts & dbytes & 0.973 & ct\_srv\_src & ct\_dst\_src\_ltm & 0.954 \\ dpkts & dloss & 0.980 & ct\_srv\_src & ct\_srv\_dst & 0.949 \\ sybytes & sloss & 0.996 & ct\_dst\_ltm & ct\_src\_dport\_ltm & 0.962 \\ dybtes & dloss & 0.997 & ct\_dst\_ltm & ct\_src\_ltm & 0.902 \\ snpkt & is\_sm\_ips\_ports & 0.942 & ct\_src\_dport\_ltm & ct\_dst\_sport\_ltm & 0.908 \\ swin & dwin & 0.980 & ct\_src\_dport\_ltm & ct\_src\_ltm & 0.909 \\ ct\_dst\_src\_ltm & ct\_srv\_dst & 0.960 & is\_ftp\_login & ct\_ftp\_cmd & 0.999 \\ \hline \end{tabular}
\end{table}
Table 7: Feature Correlation Index.  
Figure 8: Feature importance map for the UNSW_NB15 dataset.