# Deep-Learning-Based Approach to Detect ICMPv6 Flooding DDoS Attacks on IPv6 Networks
## 4 The Proposed Approach
### Ensemble Feature Selection Technique  
The ensemble feature selection process involves reducing the number of input variables while developing a predictive model. Reducing the number of input variables results in lower modeling computational costs and could improve the model's performance. Meanwhile, it aims to select the significant features that contribute to detecting ICMPv6-based attacks using two feature selection algorithms that distinguish between normal and attack traffic. These algorithms are information gain ratio (IGR) and the chi-square technique (CHI) [30]. IGR and CHI are among the two most effective algorithms in data analysis and are commonly used for dimensionality reduction. Employing several feature selection algorithms helps to provide a consensus on the set of features that significantly contribute to the detection of ICMPv6 attacks. In addition, the idea of ensemble feature selection algorithms has been employed in existing research to detect ICMPv6-based attacks, such as in [25]. It shows impressive results in the detection accuracy of ICMPv6 DDoS attacks. In IGR and CHI, each feature in the dataset is assigned a score value. The following math notation is an example of how IGR and CHI work: \begin{table}
\begin{tabular}{l l} \hline \hline
**Total Number of Rows** & 175,305 \\ \hline
**Categorical Data** & [normal, attack] \\ \hline
**Number of Normal Packets** & 131,859 \\ \hline
**Number of Attack Packets** & 43,446 \\ \hline
**Number of Features** & 19 \\ \hline  & Time, Source, Destination, Protocol, ICMPv6 type, \\
**Features Names** & MAC Src Addr, MAC Dst Addr, IPv6 next header, \\  & Length, Src Port, Dst Port, RA MTU, RA router lifetime, \\  & RA prefix, RA flag, NA flags, NS target, MLD flags, Class \\ \hline  & ICMPv6 Type, Src Port, Dst Port, RA MTU, \\
**Numerical Features** & RA router lifetime, \\  & RA prefix, RA flag, NA flags, NS target, MLD flags \\ \hline
**Text Features** & Time, Source, Destination, \\  & Protocol, MAC Src Addr, MAC Dst Addr, class \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Description of the dataset. Let \(f\) be the basic features of the dataset where  
\[f=f_{1},f_{2},f_{3}\cdots f_{n}\]  
where \(n=19\). Applying IGR on f will result in the following:  
\[IGR\ (f^{\prime})=(f_{1},s_{1}),(f_{2},s_{2}),(f3,s3)\cdots(f_{n},s_{n})\]  
where \(s\) is the score value of each feature. Meanwhile, applying CHI on f will result in the following:  
\[CHI\ (f^{\prime})=(f_{1},s^{\prime}_{1}),(f_{2},s^{\prime}_{2}),(f3,s^{\prime}_{ 3})\cdots(f_{n},s^{\prime}_{n})\]  
where \(s^{\prime}\) is the score value of each feature. The dataset features have been assigned a score value after applying IGR and CHI. The larger the feature's score value, the more important it is. By contrast, features with a small weight value reflect low importance. Then, the scored features resulting from IGR and CHI are selected based on two different thresholds (_th1_ and _th2_), where _th1_ is the threshold for IGR (\(f^{\prime}\)), and _th2_ is CHI (\(f^{\prime}\)). Finally, the values of _th1_ and _th2_ are selected experimentally based on the observation of _th1_ and _th2_'s impact on detection model performance. The resulting set of features after applying _th1_ is  
\[IGR(f^{\prime})=f_{1},f_{2},f_{3}\cdots f_{m}\]  
Meanwhile, the resulting set of features after applying _th2_ is  
\[CHI(f^{\prime})=f_{1},f_{2},f_{3}\cdots f_{m^{\prime}}\]  
where \(m\) and \(m^{\prime}<=n\). The final feature set \(f^{\prime}\) are the features that are selected by \(IGR(f^{\prime})\) and \(CHI(f^{\prime})\), denoted as  
\[f^{\prime}=(IGR(f^{\prime})\bigcap CHI(f^{\prime})\]  
In a nutshell, the ensemble feature selection technique can be denoted using math notations as follows:  
\[A=(x_{1},y_{1})\quad and\quad B=(x_{2},y_{2})\]  
where \(A\) is \(IGR(f^{\prime})\), \(B\) is \(CHI(f^{\prime})\), \(y_{1}\) is the rank value for IGR, and \(y_{2}\) is the score value for CHI.