# Effective Feature Selection Methods to Detect IoT DDoS Attack in 5G Core Network
## 6 Analysis of Experimental Results
### Comparison of Time Complexity  
Figure 8 and Table 13 show the time complexity change according to the dataset size change. When all features were used, the required time increased remarkably as the dataset increased. In particular, KNN, which compares all data, and stacking, which is an ensemble technique of several models, showed the time required in units of the hour as the data increased. However, both algorithms maintained the required time in units of seconds when using features selected for feature selection. In particular, the stacking algorithm, which showed the best performance, showed a greater rate of change (between the base model and the model using feature selection) as the dataset increased. When 364,000 packets were used for the stacking algorithm, the time required for the base model was increased by 57.6 times compared to the time required for the model using feature selection, and in the case of using 455,000 packets, it increased by 84.07 times. As a result,  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Dataset Used** & **ML Algorithm** & \begin{tabular}{c} **Feature Selection** \\ **Method** \\ \end{tabular} & **Accuracy** & **F1-Score** & **Ref.** \\ \hline KDD Cup 1999, & k-means++ and & \begin{tabular}{c} Importance measurement \\ using OOB of RF \\ \end{tabular} & 92.62\% & 91.02\% & [22] \\ \hline \multirow{6}{*}{\begin{tabular}{c} Their own dataset \\ \end{tabular} } & \multirow{3}{*}{SVM} & Filter & 92.46\% & 90.43\% \\ \cline{2-6}  & & Wrapper & 92.15\% & 90.21\% \\ \cline{2-6}  & & Embedded & 92.46\% & 90.6\% \\ \cline{2-6}  & & Filter & 97.15\% & 96.92\% \\ \cline{2-6}  & & Wrapper & 98.3\% & 97.7\% \\ \cline{2-6}  & & Embedded & 96.3\% & 97.8\% \\ \cline{2-6}  & & Filter & 92.28\% & 90.2\% \\ \cline{2-6}  & & Wrapper & 91.44\% & 87.89\% \\ \cline{2-6}  & & Embedded & 92.09\% & 89.06\% \\ \cline{2-6}  & & Filter & 95.7\% & 93.6\% \\ \cline{2-6}  & & Wrapper & 94.87\% & 92.01\% \\ \cline{2-6}  & & Embedded & 95.09\% & 93.18\% \\ \hline \multirow{6}{*}{\begin{tabular}{c} 5G dataset \\ (Collected using MedBIoT) \\ \end{tabular} } & \multirow{3}{*}{\begin{tabular}{c} KNN \\ \end{tabular} } & \multirow{3}{*}{\
\begin{tabular}{c} 44.72\% \\ \end{tabular} } & \multirow{3}{*}{
\begin{tabular}{c} 26.57\% \\ \end{tabular} } \\ \cline{2-6}  & SVM & & 50\% & 16.67\% \\ \cline{1-1} \cline{2-6}  & RF & & 62.48\% & 58.86\% \\ \cline{1-1} \cline{2-6}  & Stacking & & 62.65\% & 29.83\% \\ \hline \hline \end{tabular}
\end{table}
Table 12: Comparison of the results with similar related works.  
as the dataset increases exponentially, the difference in time complexity between the base model and the model to which feature selection is applied will gradually increase.  
The time complexity change experiment, according to the dataset size change, shows the effect of detecting a DDoS attack using the feature selected in a 5G network where a lot of IoT data is generated. Preprocessing through feature selection is useful and effective in detecting IoT DDoS attacks with low latency in 5G networks.  
Thus, 5G should provide services to users with low latency. This requires ML-based automated intrusion detection systems to detect DDoS attacks at high speeds. Through experiments, this study confirmed that the feature selection process could have a significant effect on reducing the time complexity. In addition, compared with the large reduction in time required, the performance was maintained and improved. This shows that research related to feature engineering to detect large-capacity DDoS attacks in real time in 5G mobile networks is significant.  
Figure 8: Time complexity by dataset size of the base model and the best model applying each feature selection method: (**a**) DT; (**b**) RF; (**c**) KNN; (**d**) Stacking.