# Effective Feature Selection Methods to Detect IoT DDoS Attack in 5G Core Network
## 4 Problem Define and Experimental Design
### Experimental Design
#### 4.2.3 Experimental Method Design  
(1) Feature Extraction and Encoding  
The GTP-U packets described in Section 4.2.2 were collected in a PCAP file format. Therefore, the header information at the GTP-U packet level was extracted using Tshark. Headers with values were considered as features and saved in a CSV file format. Table 3 lists the features extracted using each packet protocol. Among the 55 extracted features, object-type features were encoded, and the IP address was converted into an integer after removing the decimal point. Features in the form of hexadecimal strings were also converted into decimal integers. All encoded features were input into the feature selection process to identify the smallest possible number of feature combinations while maintaining or increasing detection performance. (2) Feature Selection  
The purpose of the feature selection step is to determine the smallest number of feature combinations to achieve effective 5G malicious packet detection. This study utilized the Scikit-learn library for the filter (feature importance) and wrapper (RFE, RFECV, and SFS) methods. Each feature selection method was performed for all supported classification algorithms. RFECV and SFS, whose cross-validation can be specified, were applied using stratified K-folds as in the training and classification stages. Furthermore, for those algorithms that can specify the number of features required for selection (feature importance, SFS, and RFE), 5 or 10 features were specified for a performance comparison according to the number of features. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**UE Numbers** & **Source IP** & **TEID** & **UE Numbers** & **Source IP** & **TEID** \\ \hline UE 1-1 & 192.168.2.1 & 2 & UE 1-11 & 192.168.3.11 & 42 \\ UE 1-2 & 192.168.2.3 & 6 & UE 1-12 & 192.168.3.12 & 46 \\ UE 1-3 & 192.168.2.7 & 10 & UE 1-13 & 192.168.3.13 & 50 \\ UE 1-4 & 192.168.2.13 & 14 & UE 1-14 & 192.168.3.14 & 54 \\ UE 1-5 & 192.168.2.15 & 18 & UE 1-15 & 192.168.3.20 & 58 \\ UE 1-6 & 192.168.0.110 & 22 & UE 1-16 & 192.168.3.22 & 62 \\ UE 1-7 & 192.168.100.5 & 26 & UE 1-17 & 192.168.3.107 & 66 \\ UE 1-8 & 192.168.100.22 & 30 & UE 1-18 & 169.254.176.87 & 70 \\ UE 1-9 & 192.168.3.1 & 34 & UE 1-19 & 169.254.174.17 & 114 \\ UE 1-10 & 192.168.3.7 & 38 & UE 1-20 & 0.0.0.0 & 78 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Source IP and uplink TEID assigned per UE. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Protocol** & \multicolumn{5}{c}{**List of Features**} \\ \hline ICMP (4) & type & code & checksum & checksum\_status & \\ \hline IGMP (5) & type & max\_resp & checksum & checksum\_status & num\_grp\_recs \\ \hline \multirow{4}{*}{TCP (17)} & port & seq & seq\_raw & urgent\_pointer & \\  & ack & ack\_raw & ack\_nonzero & window\_size & \\  & flags & flags\_res & flags\_urg & flags\_ack & flags\_push \\  & flags\_syn & flags\_fin & checksum & checksum\_status & \\ \hline UDP (5) & src\_port & dst\_port & checksum & checksum\_status & length \\ \hline \multirow{2}{*}{IPv4 (10)} & version & len & id & flags & frag\_offset \\  & ttl & proto & checksum & src\_ip & dst\_ip \\ \hline \multirow{4}{*}{GTP-U (14)} & flags & flags\_e & flags\_reserved & flags\_payload & flags\_version \\  & flags\_s & flags\_pn & ext\_hdr\_next & ext\_hdr\_length & \\ \cline{1-1}  & message & teid & ext\_hdr\_pdu\_ses\_con\_pdu\_type & \\ \cline{1-1}  & ext\_hdr\_pdu\_ses\_con\_qos\_flow\_id & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Features extracted from each packet. Classifier Model  
This malicious network detection experiment was conducted using four classification algorithms: DT, RF, KNN, and a stacking ensemble. The regression model of the stacking ensemble algorithm used DT, RF, KNN, and meta-regressors used logistic regression. Each ML classification algorithm was implemented using Python's Scikit-learn library and trained using cross-validation to prevent overfitting. Stratified K-fold (n_splits = 7) was used to include all label values in the training set.