## 4 Results
### Machine Learning-Based IDS on the Cloud with FS Methods
#### 4.2.5 Comparison of XGBoOST-, LSTM-, RF-, and MLP-Based IDS on the Cloud with FS Techniques  
FS involves choosing a subset of the most informative features from the original set while reducing dimensionality. It aims to retain the semantic interpretability of the selected features. In contrast, FE transforms the original features into a new low-dimensional space using mathematical projection. Although it effectively reduces dimensionality, the extracted features lose their intuitive meanings.  
For an IDS, FS allows the creation of a lightweight and efficient IDS by carefully selecting relevant original features. On the other hand, FE techniques provide a valuable way to transform and distill the essence of the original feature set, reducing overall data dimensionality while preserving critical information. Both FS and FE are essential tools for enhancing the cybersecurity posture of IoT ecosystems, ensuring effective threat detection tailored to the limitations and intricacies of IoT devices and networks.  
Two FS/FE techniques, i.e., PCA and chi-square, are applied to the XGBoost-, LSTM-, RF-, and MLP-based IDSs. The results for LSTM showed that chi-square performed best with 15 out of 40 selected features, achieving a detection accuracy of 94.5%. With RF, PCA proved to be the most effective technique, resulting in a detection accuracy of 97.5% using 25 features. Similarly, for MLP, PCA resulted in the best detection accuracy of 94% with 15 features. XGBoost trained with features selected by chi-square gave the best results. With 25 features, the accuracy is 98.35%, while with 15 features the accuracy is 98.13%. The results above indicate that the highest training accuracy attained with the FS/FE technique is 98.35%, whereas without using FS/FE, it reaches 99.5%. While reducing features might reduce prediction time for an IDS, prioritizing accuracy remains crucial for effective IDS implementation, even if it means retaining a higher number of features. Therefore, the XGBoost-based IDS without FS/FE outperformed the other ML-based IDSs evaluated in this study.  
We compared the inference times of the FS and FE techniques. We analyzed the inference times of the XGBoost models trained with both FS and FE as shown in Table 6. The simulations are carried out on Intel(R) Core(TM) i5-8250U CPU with 8 GB RAM. The inference time of XGBoost without FS/FE is 0.6631 milliseconds. The chi-square method (FS) showed a higher inference time compared to the PCA method (FE). Overall, the inference time with FS/FE was more than double that of the XGBoost model without them.  
While FS/FE reduced the inference time of XGBoost compared to no FS, real-time testing considers the combined time of both FS/FE and XGBoost inference. Importantly, FS is a one-time calculation performed during training. In the testing phase, directly selecting the top features from the high-dimensional data for dimensionality reduction can be a preferred choice. However, applying FS to real-time captured packets incurs a higher time cost than XGBoost inference itself.  
Our discussions and results align with the detailed research presented in [42; 43]. For time-critical attacks like DoS/DDoS and MitM, a low inference time is crucial for the IDS. Therefore, we deployed the XGBoost model (estimator = 150) without FS/FE due to its superior accuracy and faster inference time.