## 5 Summary and Conclusions  
This paper proposes a feature selection approach using the concept of mathematical set theory for machine learning-based IDS to extract efficient subsets of features. The developed machine learning-based IDS scheme has 3-phases: a data preprocessing phase, a dimensionality reduction, and feature selection phase, and a model training and classification phase. The dimensionality reduction phase has two subphases. In phase 2:A, we ranked the features using IG and GR filter-based approaches to produce the top 60 ranked and top 20 ranked subsets of features for the IoTID20 dataset as well as for all features and top 20 ranked for the case of the NSL-KDD dataset. In the second subphase of dimensionality reduction, we developed a hybrid feature selection approach using intersection and union rules. The second subphase produces a features subset that is optimized for performance via the elimination of redundant features. The model training/classification phase applies five ML algorithms, namely bagging, ANN, J48, kNN, Ensemble algorithms to classify the generated subsets of traffic features into normal or intrusion classes as binary classification as well as multi-classes for the purpose of multi-classification. The advantage of the ensemble-based hybrid approach is that the selected feature subsets provide optimum results. Even though dimensionality has been reduced, the resultant features produce an optimum classification. These results give us an indication that the current feature selection approaches are unable to extract the relevant features and eliminate irrelevant features; thus, we come to a trade-off between the two best entropy feature selection approaches to improve the inadequacies of each one.  
To conclude, the ensemble method has provided better results in classification performance for both the IoTID20 and NSL-KDD datasets compared to related works and individual ML algorithms. This is the result from eliminating irrelevant features before the training process. The experiments demonstrated a significant improvement in the realms of accuracy, precision, recall, f1-measure, and the ROC area.  
In the future, we seek to deploy our proposed system to be used by an IoT gateway device for the delivery of detection and classification services against various cyber-attacks and intrusions within a network of IoT devices (e.g., a network of Advanced RISC Machine (ARM) or Arduino raspberry Pi nodes). Further investigation regarding resource consumption can be characterized and reported as additional evaluation parameters to enhance our studies of the proposed IoT-IDS testbed. This can include the analysis of energy consumption, inferencing overhead, memory utilization, and processing complexity using resource aware IoT nodes with tiny system elements.  
Conceptualization, K.A.; methodology, K.A.; software, K.A., Q.A.A.-H.; validation, K.A., F.T.S. and Q.A.A.-H.; formal analysis, K.A.; investigation, K.A., F.T.S., Q.A.A.-H., A.A.J. and M.A.; resources, K.A., Q.A.A.-H.; data curation, K.A.; writing--original draft preparation, K.A., Q.A.A.-H.; writing--review and editing, K.A., Q.A.A.-H., F.T.S., S.A.A., A.A.J. and M.A. visualization, K.A., Q.A.A.-H., A.A.J. and M.A.; supervision, F.T.S. project administration, K.A.; funding acquisition, S.A.A. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
Not applicable.  
The researchers would like to thank the Deanship of Scientific Research, Qassim University for funding the publication of this project.  
The authors declare no conflict of interest.