# A Feature Analysis Based Identifying Scheme Using GBDT for DDoS with Multiple Attack Vectors
## 5 DDoS Classifier Optimization
### Feature Selection
```
0: datasets D;Feature set A;Learning algorithm GBDT; Threshold value of feature importance score \(\Omega\); Pearson correlation coefficient threshold \(\rho_{0}\)
0: feature subset A2
1: Calculate the importance score of feature set A using a random forest. 2: Sort the scores and select the feature subset A1 with a score greater than \(\Omega\)
3: for i in \(|A1|\):
4: for j in \(|A1|\):
5:\(\varrho\) = Pearson(i,j)
6: if \(\varrho>\rho_{0}\) then:
7: list.add([i,j])
8: Combine related features in the list to obtain a new list 1
9: for h in list1:
10: A1 = A1-lowerscore(h)
11: Test = 0, Set A2 = \(|\)
12: A1 sorts in descending order of score
13: for k in A1:
14: testscore = CroossGBDT(A2, k)
15: if testscore > test
16: A2.add(k), test = testscore
17: Output feature subset A2
```  
**Algorithm 1**Feature selection algorithm  
This paper proposes a feature selection method based on a random forest and Pearson correlation coefficients. The random forest is used to calculate the importance score for each feature. The features with a feature importance score that is higher than \(\Omega\) are then combined into a feature subset. The pairwise features of the resulting feature subset are calculated for their Pearson correlation coefficients. The feature for which the Pearson correlation coefficient \(\rho_{x,y}>\varrho\) (\(\varrho\)0, the Pearson correlation coefficient threshold) has the smallest importance score is removed. The remaining feature subsets are sequentially input into the GBDT algorithm. If the feature and the previous feature together improve the test accuracy of the GBDT algorithm, the feature is selected as the result feature; otherwise, the feature is not added as the result feature. The specific algorithm is shown in Algorithm 1. The Pearson(i, j) function of the fifth line of the algorithm refers to the Pearson correlation coefficient for calculating the feature i and the feature j. Line 7 describes that if the Pearson correlation coefficient of feature i and feature j is greater than \(\varrho\)0, then features i and j are added to the list. In the algorithm,list refers to a list of feature sets, for example list = [[1; 2], [4; 5], [5; 13]], where the Pearson correlation coefficient of features 41 and 42 is greater than \(\phi\)0, so feature 41 and 42 join the list, resulting in a new list given by list = [[1; 2], [4; 5], [5; 13], [41; 42]]. Line 8 refers to the combination of two related features, such as combining the two related features in the list to obtain list = [[1; 2], [4; 5; 13], [41; 42]]. The function of lowerscore(h) on line 10 indicates that features with lower importance scores are obtained. For example, when h = [4; 5; 13], feature 4 scores the highest, so the function lowerscore(h) returns the set [5; 13]. The 14 th line shows the function CroossGBDT(A2, k), which refers to a new feature subset consisting of a feature subset and a feature k, and the new feature subset is input into the GBDT algorithm to return the test set. The feature selection algorithm in this paper is called RFPW (random forest and Pearson wrap).