# Effective Feature Selection Methods to Detect IoT DDoS Attack in 5G Core Network
## 7 Conclusions
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multirow{2}{*}{**Algorithm**} & \multirow{2}{*}{**Selection Method**} & \multirow{2}{*}{**No. of Features**} & \multicolumn{6}{c}{**The Required Time (s)**} \\ \cline{3-8}  & & & **91,000** & **182,000** & **273,000** & **364,000** & **455,000** \\ \hline \multirow{5}{*}{DT} & - & 55 & 2.298 & 4.535 & 6.968 & 9.673 & 11.973 \\  & Feature importance & 10 & 1.177 & 2.479 & 3.627 & 4.661 & 5.823 \\  & RFE & 5 & 0.988 & 1.814 & 2.699 & 3.475 & 4.324 \\  & RFECV & 41 & 1.858 & 3.934 & 5.962 & 8.076 & 10.090 \\  & SFS (forward) & 5 & 0.705 & 1.298 & 1.931 & 2.501 & 3.147 \\  & SFS (backward) & 10 & 0.752 & 1.394 & 2.167 & 2.792 & 3.643 \\ \hline \multirow{5}{*}{RF} & - & 55 & 7.106 & 13.865 & 21.069 & 29.293 & 37.363 \\  & Feature importance & 10 & 6.067 & 10.636 & 15.536 & 21.037 & 26.800 \\  & RFE & 10 & 5.757 & 10.152 & 14.969 & 20.133 & 25.806 \\  & RFECV & 39 & 6.669 & 12.926 & 19.823 & 27.077 & 34.637 \\  & SFS (forward) & 5 & 5.418 & 8.808 & 12.177 & 16.422 & 21.010 \\  & SFS (backward) & 5 & 5.357 & 8.774 & 12.450 & 16.352 & 20.611 \\ \hline \multirow{5}{*}{KNN} & - & 55 & 141.467 & 585.745 & 1445.308 & 2889.444 & 4626.100 \\  & SFS (forward) & 10 & 6.659 & 13.214 & 22.522 & 29.400 & 39.097 \\ \cline{1-1}  & SFS (backward) & 10 & 6.467 & 13.3 & 21.428 & 28.367 & 37.891 \\ \hline \multirow{2}{*}{Stacking} & - & 55 & 316.492 & 1205.926 & 2807.596 & 5255.847 & 9243.293 \\ \cline{1-1}  & feature selection & 10 & 25.529 & 45.827 & 68.820 & 91.241 & 109.952 \\ \hline \hline \end{tabular}
\end{table} 
Table 13: Comparison of time complexity change according to dataset size change for the base model and the best model applying each feature selection method. gNBs in real time. Simultaneously, we will conduct a feature study to detect more diverse types of DDoS attacks with low latency. In addition, 5G traffic was collected from the N3 network interface and entered from the gNB to the core in this study. However, because various network interfaces are used at the 5G core, a DDoS attack detection study that considers packets in other network interfaces is required. The feature selection study for real-time detection of 5G mobile network DDoS attacks presented in this paper can be utilized in various applications. In particular, it can be utilized in a lightweight ML-based security function that can be operated in a 5G or 6G environment. Therefore, we plan to conduct feature engineering research that can be utilized in DDoS detection to achieve lower computational and time complexities. In addition, we plan to analyze the structure and procedure of the 5G core function and research a plan for the network function model that performs AI-based security detection in the 5G network standard structure. Conceptualization, Y.-E.K. and H.K. ; methodology, software, validation, Y.-E.K. ; formal analysis, Y.-E.K. and H.K. ; investigation, resources, data curation, Y.-S.K. ; writing--original draft preparation, Y.-E.K. and Y.-S.K. ; writing--review and editing, Y.-E.K. ; visualization, Y.-E.K. and Y.-S.K. ; supervision, project administration, funding acquisition, H.K. All authors have read and agreed to the published version of the manuscript. This work was supported by Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea government (MSIT) (No. 2021-0-00796, Research on Foundational Technologies for 6G Autonomous Security-by-Design to Guarantee Constant Quality of Security). Not applicable. The authors declare no conflict of interest.