## 2 Materials and Methods
### Data Preprocessing
#### 2.3.3 Feature Extraction and Grouping  
Originally, the creators of the BoT-IoT dataset extracted 46 features, out of which they identified the 19 most significant features. Out of these 19 features, four were dropped during data cleaning. The remaining 15 features undergo preprocessing. The features 'category','subcategory', and 'proto' have sub-features. After flattening the hierarchy, we obtain 26 features as shown in Figure 3.  
As BoT-IoT is a natural dataset, correlation among features is present. This correlation among features indicates redundancy and can lead to overfitting [15]. It is imperative to reduce or completely remove the correlation. Initially, some redundant and correlated columns were dropped in earlier preprocessing phases. However, the correlation among selected features is still fairly high. Figure 4 is a correlogram that shows both positive and negative correlations among features. We used the Pearson Correlation Coefficient to measure the linear relationship among the features of the BoT-IoT dataset. It gives a value on a spectrum between \(-1\) to 1. A value greater than zero signifies a positive relationship, while a value less than zero denotes a negative relationship. A high positive or negative value implies a stronger correlation among the features [16; 17].  
Figure 4: Correlation in original feature sets.  
Figure 3: Feature selection using Pearson Correlation Coefficient.  
A feature is regarded as good if its correlation score with respect to other features is low [15; 18]. This means that features are unrelated to each other and do not carry any redundant information.  
We removed the features with a high correlation score. Thus, based on the correlation-removal method, we selected three sets of features. When the correlation threshold is set at 55, we obtain all the highly correlated features removed and obtain only 14 significant features out of 26. Table 2 gives the description of the final selected features after dropping insignificant and correlated columns. The correlogram in Figure 5 shows us the remaining features and their score. This set includes the following features: 'pkSeqID','stddev','min','state_number', 'date', 'proto_arp', 'proto_icmp', 'proto_ipv6-icmp', 'proto_tcp', 'category_DDoS', 'category_Reconnaissance','subcategory_HTTP','subcategory_OS_Fingerprint', and'subcategory_UDP'.  
By further decreasing the threshold to 45, we obtain 11 features. Figure 6 represents the correlogram of these features, and the features are as follows: 'pkSeqID','stddev',  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Feature** & **Description** \\ \hline pkSeqID & Row Identifier \\ Proto & Textual representation of transaction protocols present in network flow \\ Seq & Argus sequence number \\ Stddev & Standard deviation of aggregated records \\ N\_IN\_Conn\_P\_SrcIP & Number of inbound connections per source IP. \\ Min & Minimum duration of aggregated records \\ state\_number & Numerical representation of feature state \\ Mean & Average duration of aggregated records \\ N\_IN\_Conn\_P\_DstIP & Number of inbound connections per destination IP \\ Date & Destination-to-source packets per second \\ State & Source-to-destination packets per second \\ Max & Maximum duration of aggregated records \\ Category & Traffic category \\ Subcategory & Traffic subcategory \\ \hline \hline \end{tabular}
\end{table}
Table 2: The best 14 features cited.  
Figure 5: Correlation in 14-feature set.  
and 'AR P Proto P Sport' had nominal importance scores, suggesting no significant impact on the model's performance, so all these features were eliminated.  
This feature-importance analysis underscores the effectiveness of our feature-selection process and highlights the critical variables that contribute to the detection and classification of network events.