## 3 Materials and Methods
### Feature Selection for Malicious Traffic Classification  
FS is a critical step in the machine learning workflow that involves identifying and selecting a subset of relevant features for use in model development [28]. The primary goal of FS is to improve the model's performance by removing irrelevant or redundant data, which can lead to overfitting and increased computational complexity [26]. This step is significant in high-dimensional data scenarios, where the number of features can be overwhelming, leading to the \"curse of dimensionality\" [17]. To address the need for efficient feature selection in our study, we introduce the SMDT method. SMDT leverages central moments (mean, standard deviation, skewness, and kurtosis) to identify the most significant features that distinguish legitimate from malicious traffic. These central moments were chosen for their complementary roles in capturing diverse statistical properties of the data: mean and standard deviation measure central tendency and variability, respectively, while skewness and kurtosis provide insights into the shape and extremities of the distribution [29]. These properties are particularly suited for the heterogeneous and often skewed distributions of IoT traffic data, where distinguishing benign and malicious patterns requires multidimensional statistical perspectives. The diverse nature of IoT networks, with protocols like MQTT and varied attack patterns, often results in non-Gaussian data distributions; hence, IoT traffic's complex and varied nature benefits significantly from such multidimensional statistical analysis. Unlike traditional feature selection methods, such as variance-based techniques that may overlook \begin{table}
\begin{tabular}{l c l} \hline \hline
**Tools/Software/Library** & **Version** & **Role** \\ \hline Anaconda & 4.14.0 & Package management and environment management \\ Jupyter Notebook & 6.4.8 & Interactive development environment \\ Python & 3.9.12 & Programming language \\ Pandas & 1.4.4 & For data manipulation and analysis \\ NumPy & 1.22.4 & For numerical operations \\ Scikit-Learn & 1.0.2 & For machine learning tasks including preprocessing, model training, and evaluation \\ Seaborn & 0.11.2 & For statistical data visualization \\ Matplotlib & 3.5.1 & For data visualization \\ TensorFlow & 2.10.1 & For building and training neural networks \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Utilized tools and libraries. subtle but critical variations or correlation-based methods that primarily focus on linear relationships, SMDT identifies features with both linear and non-linear discriminatory power. Hence, the SMDT method ensures the retention of only those features that exhibit significant divergence in their statistical moments between legitimate and malicious traffic. This is achieved through lightweight computations of central moments, which significantly reduce the feature set. As a result, the method simplifies ML models and enhances both training and testing times (and inference speeds during production), addressing the resource constraints typical of IoT devices. Additionally, the reduced computational overhead enables real-time processing capabilities, which are critical for ensuring IoT security. As mentioned previously, in this study, we focus on the first four conventional statistical moments [30]: the first moment (the mean), the second central moment (the variance), and higher-order central moments such as skewness (the third moment) and kurtosis (the fourth moment). The SMDT approach involves a few steps. First, the dataset is split into separate subsets representing the legitimate and attack classes. For each subset (legitimate and attack classes), we calculate the statistical moments for each feature. As previously mentioned, these moments include the following:  
* The first moment, referred to as mean (\(\upmu\)), measures the central tendency that represents the average value of the feature.