## 4 Feature Extraction and Selection
### Feature Evaluation and Correlation Analysis  
During feature evaluation, we analyze the impact of each feature for predicting the four target variables for each trace. Then, we extract a representative and robust subset of features that is sufficiently accurate for performing the predictions across all 17 traces, giving us confidence that these features will also work with other traces. To do so, we use four different and widely used statistical metrics: (i) the _p-value test_, (ii) the _Chi-squared test_, (iii) the _Gini Importance_, and (iv) the _Correlation Matrix_. Each test provides a different perspective on the relationship between features and the target variable, and using them together can lead to more robust and reliable feature selection. The _p_-value test determinesthe features that have a strong relationship (\(p\leq 0.05\)) with the target variable, the Chi-squared test indicates the probability of predicting values closer to the testing samples, the Gini Importance metric (calculated from a Random Forest model) determines the importance of each feature in predicting the target variable, and the Correlation Matrix expresses the correlation of extracted features between them. Next, we present the detailed results of the four metrics for the Next Offset target. The results for the other target variables are similar. According to the \(p\)-value metric, the _File Size_, _History of Open Times 10_, _Request Offset_, _File Fully Read Frequency_, and _File Temporal Pattern Frequency_ are highly important to predict the Next Offset. The connection between some of these features is clearly explained by their nature. For instance, the _Request Offset_ is often correlated with the next offset because of the high frequency of sequential operations. However, the connection between features such as the File Size or the History of open times with \(\Delta=10\) is not so straightforward. This happens because the \(p\)-value might produce false positives due to incorrect connections with the target variable. For example, _History of Open Times 10_ is frequently set to 0 because many files are not opened 10 times or more, while the (normalized) next offset is often very close to zero due to the many reads that start at the beginning of a file. Thus, employing the three metrics in conjunction is valuable for diminishing the possible false-positive effect from a single metric. Following the \(p\)-value, the Chi-squared test also gave a high score for the _Request Offset_ and _File Fully Read Frequency_. These features have higher scores in Traces 14-17, which are traces with a high number of sequential read requests. In contrast with the \(p\)-value metric, the _File Size_ received a lower score from the Chi-squared test. It is interesting to observe that file access patterns received high scores from both metrics. For instance, the _File Length Pattern_ and the _File Spatial Pattern_ received a positive \(p\)-value score, while their weight received a high Chi-squared score. The access patterns related to files and directories received the highest scores, while the file format patterns received, in general, lower scores. This indicates that the file access patterns are correlated to the target variables and can help the prediction models. The key results from the Gini Importance are similar to the Chi-squared results and are not elaborated due to space constraints. Finally, our correlation analysis has revealed that most of the features exhibiting a correlation are features related to the access patterns. This happens because many patterns are mutually exclusive. For instance, a file can only be currently either sequentially accessed or not. Note that the patterns for the File Format are typically correlated with the Directory patterns. This happens because many directories often host files with the same formats. The correlation is similar across all target variables.