# Enhancing IoT Network Security Using Feature Selection for Intrusion Detection Systems
## 5 Discussion
### Inbound Packet Count as a Marker of Distributed Denial-of-Service (DDoS) Attacks  
Our results identified a significant correlation between 'Inbound Packet Count' and DDoS attacks, validating its role as a critical feature in IoT network intrusion detection. The results from our analysis demonstrate how abnormal spikes in inbound packet counts are strongly associated with these types of attacks, providing a robust metric for identifying DDoS activities and enhancing detection frameworks.  
The 'Inbound Packet Count' metric is one of the most critical metrics from the perspective of DDoS attacks, especially in IoT networks. DDoS attacks disrupt and overwhelm network resources by delivering a high volume of inbound packets from several sources. Hence, the count of inbound packets is one important feature to monitor in IoT environments. IoT devices such as thermostats, webcams, and refrigerators do not possess adequate measures of security or receive frequent updates; thus, they are susceptible to being co-opted by botnets in DDoS attacks [61]. The IoT-DH dataset, which is specifically designed for detecting and classifying DDoS attacks, has been used to demonstrate that in bound packet counts can be leveraged to effectively identify and mitigate these threats [54]. From an analysis of the KDD99 and IoTID20 datasets, traffic scenarios related to common and emerging attack patterns can be identified [73].  
As discussed by [PERSON] and [PERSON] [74], robust defenses can be developed by gaining an understanding of several operational mechanisms of DDoS attacks across various layers of the IoT architecture. Machine learning can be utilized to analyze IoT network traffic using several techniques to detect vulnerabilities that are based on unusual patterns in the inbound packet counts, such as those associated with unencrypted data transfer [67]. The DDoS-FOCUS model employs deep learning criteria to accurately detect and mitigate DDoS attacks, based on the inbound packet count [62]. [PERSON] and [PERSON] proposed a machine-learning-based approach to dynamically leverage attribute selection by focusing on important features, such as inbound packet counts, to enhance the detection of DDoS attacks [75]. Overall, the performance of IoT networks can be optimized and their complexity can be reduced using the appropriate feature selection techniques and by focusing on important metrics, such as inbound packet counts [76]. The detection methods based on variations in entropy measures also make use of the count of inbound packets to identify anomalies in traffic density, thereby indicating the existence of DDoS attacks [60]. The DoS/DDoS-MQTT-IoT dataset highlights the importance of analyzing the counts of inbound traffic in the context of specific IoT communication protocols, namely, MQTT. This leads to the development of effective countermeasures to manage DDoS attacks [63]. In summary, the inbound packet count enables the development of targeted detection and mitigation strategies because it acts as an indicator of potential DDoS attacks and vulnerabilities in IoT networks.