## 4 Experimental Results and Discussion
### Experimental Results and Analysis
574 Scan instances are wrongly classified as Mirai, 2 Scan instances are wrongly classified as Dos, 92 Scan instances are wrongly classified as MITM-ARP Spoofing, and Scan instance are wrongly classified as Normal. The 2839 MITM-ARP Spoofing instances are predicted correctly; 1242 MITM-ARP Spoofing instances are wrongly classified as Mirai, 8 MITM-ARP Spoofing instances are wrongly classified as Dos, 103 MITM-ARP Spoofing instances are wrongly classified as Scan, and 4 MITM-ARP Spoofing instance are wrongly classified as Normal. The 4747 normal instances are predicted correctly, and there are no (none) wrongly classified samples. Figure 10 corresponding with Table 8 presenting the accuracy results of the five various ML with different FS approaches for multi-classification using the IoTID20 dataset. In the overall observation, the ML classifiers give better, more suitable results with our proposed feature selection method (IMF, UMF). Figure 10, along with Table 8, shows the accuracy of our study by utilizing the five various ML models with different FS approaches including our hybrid FS approach for multi-classification challenges using the IoTID20 dataset. Figure 10, along with Table 8, shows that our proposed model achieved a higher accuracy of 99.70% with Ensemble using 11 and 28 features to detect the multi-classes compared to other models using different number of features. Tables 9-12 summarize values for different statistical parameters used in the multi-classification problem. Five various ML algorithms have been used with four different strategies of FS approaches. We utilized five various ML and four different ways of the FS approach to derive these performance results. The FS approaches are IG and GR and hybrid FS (IMF and UMF). As we mentioned above, these approaches were created to select the top 60 ranked features and the best 11 and 28 features using the IoTID20 dataset. Table 9 represents the results of using IG; Table 10 represents the results of using GR; Table 11 represents the results of using union theory. In Table 9, we can observe that values of (i) false positive rate (FP) and (ii) precision, (iii) recall, (iv) F-measure, and (v) ROC for each individual target (Mirai, DoS, Scan, MAS: abbreviation for MITM ARP Spoofing, normal) and the accuracy overall of the model with each different ML algorithm. For instance, in Table 9, Ensemble with IG approach gives a small false-positive rate for each prediction target which is good for the model since a high FP rate will compromise system security by authorizing malicious data to move into the network. Moreover, the FP rate will significantly increase overheads as well as consume system resources and time. Moreover, our feature selection approaches (intersection and union) as shown in Tables 11 and 12 represent the best overall results. For example, in Table 12, Ensemble with union theory, we succeed in reaching the lowest (i.e., very nearly zero) possible value of FP rate for each class (target): 0.007 for Mirai, 0 for DoS, o for Scan, 0.001 MITM ARP Spoofing, and 0 for normal which is excellent for an IDS deployed into an IoT ecosystem. However, it is not possible to reduce all FP rates to zero in the IDS model because there is the well-known trade-off between these parameters.