## 5 Results and Analytical Discussion
### Evaluating Feature Selection
#### 5.3.3 Algorithm-Specific Feature Response Mechanisms  
The varying responses to feature selection across algorithms can be attributed to their fundamental learning mechanisms when applied to DDoS detection. The performance of SVM is determined by the separation of hyperplanes within the feature space. It is particularly notable that enhanced feature selection succeeded in eliminating noisy features that had previously obstructed the optimal formation of hyperplanes between different DDoS variants, especially for DDoS_HTTP. However, despite the overall improvement, SVM continued to struggle with DDoS_TCP attacks, maintaining a high misclassification rate of 41.2% even after feature enhancement.  
Convolutional operations in CNN greatly benefited from the provision of well-prepared input data. The improved feature selection enabled more distinguishable patterns  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multirow{2}{*}{**Accuracy (Base)**} & **Accuracy** & \multirow{2}{*}{**Improvement**} & **Detection Time** \\  & & **(Enhanced)** & & **Impact** \\ \hline RFC & 93.20\% & 99.99\% & +6.79\% & +0.04 s \\ KNN (K = 3) & 81.03\% & 99.14\% & +18.11\% & +1.87 s \\ KNN (K = 5) & 80.92\% & 99.09\% & +18.17\% & +3.26 s \\ KNN (K = 7) & 81.06\% & 99.10\% & +18.04\% & +4.46 s \\ SVM & 75.06\% & 99.26\% & +24.20\% & +8.34 s \\ LSTM & 98.83\% & 99.25\% & +0.42\% & +0.00 s \\ CNN & 74.58\% & 99.80\% & +25.22\% & +0.00 s \\ \hline \hline \end{tabular}
\end{table}
Table 5: Impact of feature selection on model accuracy.  
to be captured by CNN's convolutional layers, particularly facilitating the differentiation between DDoS_ICMP and DDoS_UDP attacks.  
The operation of KNN algorithms fundamentally depends on distance calculations within the feature space. Feature selection effectively reduced dimensionality while preserving critical discriminative features, thereby allowing for more accurate nearest-neighbor identification among DDoS variants. However, KNN continued to struggle in distinguishing certain attack types (such as DDoS_HTTP versus XSS, and DDoS_TCP versus Port_Scanning), suggesting that inherent similarities in their traffic patterns challenge distance-based classification methods.  
RF showed moderate improvement, suggesting its ensemble nature and internal feature selection mechanisms already captured significant discriminative information for DDoS attack variants even in the base configuration. LSTM's minimal improvement suggests its sequential learning capabilities were already effectively capturing temporal patterns in DDoS attack traffic.  
The observed variations in performance point to the fundamental limitations of each algorithm when handling complex attack signatures in IoT systems. Enhanced feature selection can improve overall results, but ongoing misclassification across different methods shows that it remains challenging to distinguish between attacks with similar characteristics. These trends emphasize the importance of thoroughly understanding the feature space when choosing detection methods that are best suited for specific IoT deployment scenarios.