# Enhancing Machine Learning Prediction in Cybersecurity Using Dynamic Feature Selector
## 5 Experimental Analysis
### Meta-Learner
#### 5.7.5 Algorithm  
Algorithm 2 highlights the entire process. We begin by using \(L\) which consists of the list of selected features from Algorithm 1. The meta-learner uses a subset of these features to begin training. We selected this subset to have the same feature size as the ANOVA F-Test list \(L1\). Hence, 13 features from NSL-KDD and 20 features from UNSW datasets were selected to begin with. The meta-learner trains on this subset \(L^{\prime}\) and records the accuracy in a list \(P\). If the accuracy of previous iteration is less than the accuracy of current iteration, we add two subsequent features from \(L\) to the feature subset \(L^{\prime}\). However, if it is observed that the accuracy starts decreasing over two subsequent iterations, we stop the meta-learner and record the highest accuracy. The meta-learner also stops if it has added all the features from \(L\) to \(L^{\prime}\) and records the final accuracy. Tables 4 and 5 shows the list of features that were considered most important in the dynamic feature selection process by the meta-learner after feature selection algorithms were used. These features were selected by the meta-learner from the 123 one-hot encoded input features in the NSL-KDD dataset and the 196 trainable features on UNSW-NB15 dataset. In Figure 4a,c we demonstrate the accuracy of the NSL-KDD and UNSW datasets respectively which are generated from the training datasets using the selected features in Tables 4 and 5 by sequential CNN-LSTM, GRU and Bi-LSTM models. In Figure 4b,d we demonstrate the training loss of the NSL-KDD and UNSW datasets respectively using those selected features.  
```
Data:\(L[\) ; // List of selected features L from Algorithm 1 Data:\(len(L[\) ]); // Length of ANOVA feature list from Algorithm 1 Result:\(L^{\prime}\); // Final Feature List Result:\(P[\) ; // Accuracy List derived from Meta Learner # Begin Meta-Learner Approach  Initialize \(L^{\prime}[\) ; for(\(i=0\), \(i<len(L1)\), \(i++)\)do \(L^{\prime}[\)i\(]\gets L[\)i\(]\) ; // Copy initial features to L'  end for \(A\leftarrow\text{len}(L1)\); \(j\gets 0\); whileTruedo \(P[i]\leftarrow\text{Meta-Learner (CNN-LSTM, GRU, Bi-LSTM, DT, RF) on \(L^{\prime}[\) ; if\(A<len(L)\)then  break; // Stop Meta Learner since no more features to add  end if if\(i>2\)then if(\(P[i]<P[i-1]\) and \(P[i]<P[i-2]\)then  break; // Stop Meta Learner since accuracy is decreasing  else \(L^{\prime}\gets L^{\prime}+L[\)A\(]+L[\)A\(+1]\) ; // Add two more features from L \(A\gets A+2\);  end if  end if \(j++\);  end for  print(\(P[i]\)); // Print highest accuracy  print(\(MetaLearnerStats\));
```  
**Algorithm 2** Meta-Learners.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Features**} & \multicolumn{2}{c}{**XGBoost**} & \multirow{2}{*}{**Inf. Gain**} & \multirow{2}{*}{**Features**} & \multicolumn{2}{c}{**XGBoost**} & \multirow{2}{*}{**Inf. Gain**} \\  & **Imp.** & & & & **Imp.** & \\ \hline dst\_host\_srv\_count & 383.4 & 0.4179 & count & 275.3 & 0.4164 \\ \hline \hline \multirow{2}{*}{diffic} & 1223.5 & 0.2612 & dst\_host\_count & 309.4 & 0.2089 \\ \hline dst\_host\_diff\_srv\_rate & 306.4 & 0.4518 & dst\_host\_error\_rate & 269 & 0.0979 \\ \hline dst\_host\_same\_src\_port\_rate & 206.1 & 0.2358 & dst\_host\_same\_srv\_rate & 336.4 & 0.4004 \\ \hline \hline \multirow{2}{*}{dst\_host\_server\_rate} & 273.2 & 0.3986 & dst\_host\_srv\_diff\_host\_rate & 309 & 0.2614 \\ \hline \hline \multirow{2}{*}{duration} & 196.3 & 0.0647 & flag\_SF & 58.4 & 0.4892 \\ \hline \hline \multirow{2}{*}{logged\_in} & 123.9 & 0.3063 & root\_shell & 176.5 & 0.0018 \\ \hline \hline \multirow{2}{*}{service\_http} & 98.4 & 0.0011 & src\_bytes & 1321.7 & 0.7202 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Importance of final selected features of NSL-KDD.