# A Feature Analysis Based Identifying Scheme Using GBDT for DDoS with Multiple Attack Vectors
## 5 DDoS Classifier Optimization
### Feature Selection  
Feature selection has two purposes. First, for each DDoS attack, several features that best characterize the attack behavior are selected. Second, feature selection can help improve detection accuracy, reduce the false positive rate, and thus accurately use the classifier. Choosing a good attack feature can not only effectively identify DDoS attack traffic but also improve the response speed of the algorithm if the recognition rate allows. Feature selection methods are divided into three types: filtering methods, packaging methods, and embedding methods. The main idea of the filtering method is to score the importance of each feature and then select the features according to the ranking of the scores. The main methods are chi-squared test, information gain, and correlation coefficient. The main idea of the packaging method is to regard the selection of the subset as a search optimization problem, generate different combinations, evaluate the combination, and compare it with other combinations. Therefore, this approach regards the selection of subsets as an optimization problem. The main method is the recursive feature elimination algorithm. The embedding method identifies the attributes that are important to the model training during the process of determining the model. Feature selection can also be combined with the artificial ant colony algorithm, artificial bee colony algorithm, genetic algorithm, annealing algorithm, and other algorithms to obtain the best features. This paper proposes a new integrated method of feature selection based on the random forest and Pearson correlation coefficients. Random forests are a common feature selection method. In terms of DDoS attack feature selection, [PERSON] et al. [48] proposed a feature importance index based on random forests, using random forest importance scores to gradually increase features. [PERSON] et al. [49] used a random forest importance score to rank and extract top-ranking features. Random forests can effectively extract the importance scores of features but cannot distinguish the correlation between features. The method in this paper aims to calculate and rank all feature importance scores using random forests. The feature whose feature importance score is less than \(\Omega\) is removed, and \(\Omega\) is a threshold for calculating the feature importance score using the random forest. The rationale of removing the importance scores that are less than \(\Omega\) is mainly to remove those features that are not related to the classification category or those that are extremely related to the classification category. This paper  
Figure 5: ROC curve comparison. (**a**) ROC comparison of TCP flow datasets; (**b**) ROC comparison of UDP flow datasets. introduces the Pearson correlation coefficient, which examines the degree of correlation between two things. If there are two characteristics, \(X\) and \(Y\), their correlation is calculated as follows:  
\[\rho_{x,y}\ =\ \frac{N\sum XY-\sum X\sum Y}{\sqrt{N\sum X^{2}-(\sum X)^{2}} \sqrt{N\sum Y^{2}-(\sum Y)^{2}}}, \tag{2}\]  
where \(N\) is the size of the record. The meaning of the finally calculated correlation coefficient can be understood as follows: (1) When the correlation coefficient is 0, the \(X\) and \(Y\) characteristics have no relationship. (2) When the value of \(X\) increases (decreases) and the value of \(Y\) increases (decreases), the two features are positively correlated, and the correlation coefficient is between 0.00 and 1.00. (3) When the value of \(X\) increases (decreases) and the value of \(Y\) decreases (increases), the two features are negatively correlated, and the correlation coefficient is between \(-1.00\) and 0.00. The larger the absolute value of the correlation coefficient is, the stronger the correlation, and the closer the correlation coefficient is to 1 or \(-1\), the stronger the correlation, while the closer the correlation coefficient is to 0, the weaker the correlation.