## 5 Results
### Feature Selection  
Regarding feature selection, an essential step to optimize machine-learning models and reduce training time, it was possible to identify the most relevant features of the dataset, eliminating those that do not provide significant information or that could generate noise in the training. In this way, a more efficient model with better performance is obtained, in addition to facilitating the interpretation of the results. For the correct selection of the most relevant characteristics of the datasets, two machine-learning algorithms were used: Random Forest and XGBoost. These algorithms analyze the datasets and determine those features that are most important in the prediction of the models, thus seeking to reduce the dimensionality of the data and improve the efficiency of the model, without sacrificing accuracy in the detection of anomalous patterns. Using Random Forest  
Using Random Forest, the feature importance method was applied to identify the variables that most influence the model's prediction. As can be seen in Figure 4, the features with the highest weights include HHHpHpHp_L0.01, HpHpHp_L0.01, and HpHpHp_L0.1, among others. The selection of 30 features is justified as an effective measure to prevent overfitting, as it reduces the dataset's dimensionality by retaining only the most predictive variables, according to empirical importance metrics obtained through Random Forest and XGBoost. This number was not chosen arbitrarily; it was determined through preliminary experiments in which various feature set sizes were evaluated, and 30 was found to offer the best balance between model performance, computational efficiency, and generalization capability. This dimensionality reduction minimizes the risk of the model learning noise or non-generalizable patterns, aligning with the principle of parsimony. Furthermore, the small difference observed between validation and test metrics empirically confirms the absence of a significant generalization gap, validating the effectiveness of the selected subset. Consequently, the use of these 30 features significantly contributes to mitigating overfitting in the evaluated models. From the analyzed set, the 30 most important features selected by both algorithms were selected. Although in the graph it can be observed that some characteristics have a higher weight than others, there is no direct discarding of characteristics, since it is shown that each one provides relevant information for the model. In any case, it can be seen that some features have a significantly higher weight than others, indicating that they are more relevant for the detection of anomalous patterns in network traffic. As for the use of XGBoost, the analysis was carried out using the feature importance measure provided by the model and the scikit-learn library. The most important variables, as shown in Figure 5, include HH_jit_L0.01_mean, HpHp_L0.01_weight, and MI_dir_L0.1_mean. Figure 4: Most important features selected by Random Forest. Unlike Random Forest, XGBoost shows a higher variability in the importance of the features, indicating that the model prioritizes differently the most relevant variables for the detection of anomalous patterns. The analyzed characteristics have an importance index that goes from one extreme to the other, considering the important characteristics as very relevant, and relegating the rest, considering their index very close to zero. When comparing the feature selection results of both models, it was observed that 31 features were common between Random Forest and XGBoost, while 19 features were different. This comparison provides insight into how different algorithms prioritize different features in the dataset and how this affects the performance of the models. The commonality in the most important features indicates a consistency in the relevance of certain variables for DDoS attack detection, which is a positive factor for the robustness of the final model.