# Enhancing IoT Network Security Using Feature Selection for Intrusion Detection Systems
## 5 Discussion
### Flow Duration and Its Correlation with DoS and DDoS Attacks  
The results of our study identified a significant correlation between flow duration and the presence of DoS and DDoS attacks in IoT environments. This finding highlights the role of flow duration as an indicator of abnormal network behavior. The extended flow duration observed in attack scenarios aligns with the consumption of resources caused by these attacks, validating our results through evidence in the existing literature.  
Considering that flow duration is related to the nature and behavior of network traffic, it is one of the critical parameters in the domain of DoS and DDoS attacks, especially in IoT networks. Given that IoT devices are resource-constrained and operate on a limited bandwidth, an extension in the flow duration can indicate the existence of malicious activities. In particular, the resources of the target are exhausted by these attacks. The maintenance of prolonged connections by these attacks leads to the excess consumption of resources, especially bandwidth and processing power, which can result in either the denial or degradation of service [58; 59]. For example, DDoS attacks may lead to the establishment of long-lasting connections, resulting in excessive traffic flooding the network, and monitoring these deviations helps to detect the attack [60].  
Because many devices, such as smart refrigerators and webcams, do not typically possess adequate security measures, they are often targeted in IoT networks. Analysis of the duration of flow can aid in the process of identifying vulnerabilities and elucidating potential entry points for attackers [61]. Based on changes in one of the features of the network beyond a particular threshold value, abnormal flow durations can be detected. Hence, a DDoS attack causing abnormalities in the flow duration can be detected using entropy variation [60].  
Advanced detection systems, such as the FLUID system, analyze features on a multi-dimensional basis. Unified information measures and flow behavior can be incorporated into the FLUID system to identify vulnerabilities in IoT network traffic and effectively distinguish between legitimate and malicious traffic [59]. Apart from other features, the ones capturing flow duration can be analyzed using the machine learning approaches employed in the DDoS-FOCUS model to enhance detection capabilities and accurately identify DDoS attacks [62]. The CICDDoS2019 and DoS/DDoS-MQTT-IoT datasets include several scenarios related to these attacks; thus, those methods based on flow duration can be tested and validated using these datasets [63].  
Ultimately, IoT systems can be protected from the detrimental effects of DoS and DDoS attacks by developing more robust defense mechanisms based on the continuous monitoring of flow duration [58]. Moreover, detection techniques like entropy-based methods and feature mapping can be integrated with flow duration analysis to enhance resilience against several cyber threats by providing a comprehensive approach for identifying and mitigating vulnerabilities in IoT networks [64].