# Machine Learning-Based DoS Amplification Attack Detection against Constrained Application Protocol
## 3 Materials and Methods
### Feature Selection  
To train the classifiers for the multi-classification process, we need to get the most relevant features that lead to the correct label. This paper performs filtering using the Pearson Correlation method to find the most relevant features and grid of irrelevant features. It is assumed that any feature that has a \(\pm\) 0.30 correlation with the label is relevant. To remove the redundancy in the features, we use Variance Inflation Factor (VIF).  
VIF technique is to remove the collinearity features calculated from Formula (5). Using the Pearson Correlation in Formula (6), it is found that coap.block, coap.block.count, coap.block.error, coap.block.multiple_tails, coap.block.overlap, coap.block.overlap.conflicts, coap.block.reassembled.in, and coap.block.reassembled features are highly correlated with \(r=1\), so only one feature is retained coap.block, and the rest are dropped. Figure 9 shows  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Feature** & **Description** & **Type** \\ \hline Coap.block\_length & Block length & Unsigned Integer (4 bytes) \\ Coap.blocks & Block & Label \\ Coap.code & Code & Unsigned Integer \\ Coap.token\_len & Token length & Unsigned Integer (1 byte) \\ Coap.type & Type & Unsigned Integer (1 byte) \\ Coap.block & Block & Frame number \\ Coap.block.count & Block count & Unsigned Integer (4 bytes) \\ Coap.block.error & Block defragmentation error & Frame number \\ Coap.block.multiple\_tails & Block has multiple tails & Boolean \\ Coap.block.overlap & Block overlap & Boolean \\ Coap.block.overlap.conflicts & Block overlapping with conflicting data & Boolean \\ Coap.block.reassembled.in & Reassembled in & Frame number \\ coap.block.reassembled.length & Reassembled block length & Unsigned integer (4 byte) \\ coap.block.too\_long & Block too long & Boolean \\ coap.length & Length & Unsigned integer (4 byte) \\ coap.oscore\_kid & OSCORE Key ID & Byte sequence \\ coap.oscore\_kid\_context & OSCORE Key ID context & Byte sequence \\ coap.oscore\_piv & OSCORE Partial IV & Byte sequence \\ coap.payload & Payload & Character string \\ coap.payload\_desc & Payload Desc & Character string \\ coap.payload\_length & Payload Length & Unsigned integer (4 byte) \\ coap.request\_first\_in & Retransmission of request in & Frame number \\ coap.response\_in & Response in & Frame number \\ coap.retransmitted & Retransmitted & Label \\ \hline \hline \end{tabular}
\end{table}
Table 2: CoAP Non-Optional Features [36].  
the Pearson correlation between the features and in-between each feature and the label after removing the redundancy in the features.  
\[VIF_{j}=\frac{1}{1-R_{j}^{2}} \tag{5}\]  
Here \(VIF_{j}\) refers to the Variance Inflation Factor for the \(j^{th}\) predictor, and R\({}^{2}\) is calculated by regressing the \(j^{th}\).  
\[r_{xy}=\sum_{i=1}^{n}\frac{(x_{i}-\overline{x})(y_{i}-\overline{y})}{\sqrt{ \sum_{i=1}^{n}(x_{i}-\overline{x})^{2}}\sqrt{\sum_{i=1}^{n}(y_{i}-\overline{y} )^{2}}} \tag{6}\]  
where \(r_{xy}\) is the Pearson correlation between two features \(x\) and \(y\), \(n\) represents the total number of samples, \(x_{i}\) and \(y_{i}\) are the individual sample points indexed with \(i\), \(\overline{x}\) is the sample mean, and the same for \(\overline{y}\).  
As shown in Figure 9, only seven features are considered highly correlated to the label namely: coap.token_len, coap.block, coap.payload, coap.payload_length, coap.request_first_in, coap.response_in, and coap.retransmitted after removing the irrelevant features and grid of the redundant features. The feature coap.token_len is highly correlated to the label with a negative correlation of \(r=-0.82\). The feature coap.block is the less relevant feature with \(r=0.31\) with the label. As mentioned above, the threshold for the relevant feature is \(\pm 0.30\) or above. The density of the selected features is depicted in Figure 10.