## 3 Proposed Anomaly-Based IDS for IoT Ecosystem
### Hybrid Approach  
In phase 2B of Figure 1, the hybrid approach uses the concept of mathematical set theory to select the minimal set of the best features from predetermined selected features based on IG and GR. We can define the four mathematical equations as follows:  
\[Intersection\ rule\ (M\to g1\cap g2) \tag{5}\]  
\[IMFautues\ (IMF)=\ \mathrm{IG}\cap\ \mathrm{GR} \tag{6}\]  
\[Union\ rule\ (U\to g1\cup g2) \tag{7}\]  
\[UMFautues\ (UMF)=\ \mathrm{IG}\cup\ \mathrm{GR} \tag{8}\]  
where \(g1,g2\) are a subset of the whole feature set (\(F\)) where \(g1,g2\ll F\). For instance, \(g1\) holds the relevant features extracted using IG, while \(g2\) holds the relevant features extracted using GR. Hence, the union (\(U\)) chooses all elements (features) that are located either in \(g1\)  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Approach** & **\# Features** & **Extracted Features** \\ \hline IG & 20 & 7, 1, 5, 3, 8, 82, 25, 22, 73, 71, 12, 69, 11, 60, 15, 80, 13, 59, 23, 44: 20 \\ IG & 60 & 7, 1, 5, 3, 8, 82, 25, 22, 73, 71, 12, 69, 11, 60, 15, 80, 13, 59, 23, 44, 14, 47, 4, 61, 19, 83, 18, 26, 32, 42, \\ GR & 20 & 16, 34, 5, 34, 8, 22, 13, 35, 15, 60, 73, 14, 49, 48, 69, 11, 6, 25, 32 \\ GR & 60 & 16, 34, 5, 3, 54, 8, 22, 13, 35, 15, 60, 73, 14, 49, 48, 69, 11, 6, 25, 32 \\ GR & 60 & 16, 34, 5, 3, 54, 8, 22, 13, 35, 15, 60, 73, 14, 49, 48, 69, 11, 6, 25, 32, 82, 1, 83, 12, 71, 7, 26, 23, 4, 80, 42, \\ IG \(\cap\) GR & 11 & 5, 8, 25, 22, 73, 69, 11, 60, 15, 13, 3 \\ IG \(\cup\) GR & 28 & 7, 1, 5, 3, 82, 25, 22, 73, 71, 12, 69, 11, 60, 15, 80, 13, 59, 23, 44, 16, 34, 54, 35, 14, 49, 48, 6, 32 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Results from the ranking features process applied to the IoTID20 dataset.  
or \(g2\), whereas the intersection (\(M\)) selects the elements (features) that are found only in both sets (\(g1\) and \(g2\)).  
In phase 2A in Figure 1, we demonstrate feature selection via IG, GR, and filter-based ranking methods. The output of phase 2A is the extraction of two sets of features: top 60 and top 20. These two feature sets are generated independently, i.e., feature ranking from the top 60 is not carried over to the top 20. In phase 2B in Figure 1, we demonstrate the hybrid approach by implementing the intersection and union set theory rules. These rules are labeled IMF and UMF, respectively, for the intersection and union operations. The IMF and UMF rules are described by Equations (5)-(8). The hybrid approach is a manual process to produce IMF and UMF approaches (11 and 28 features from the IoTID20 dataset, and 15 and 25 features from the NSL-KDD dataset) from the top 20 ranked feature set produced by Phase 2A. Phases 2A and 2B together produce six different feature selection sets, which are: top 60 (via IG), top 60 (via GR), top 20 (via IG), top 20 (via GR), 11 IMF and 28 UMF. Due to the use of both traditional and hybrid feature selection approaches, we can, to increase the efficiency of our feature selection process, reduce the computational costs of the learning process (i.e., training and testing workflows). Corresponding features for each of the six feature sets are listed in Table 2. Also, Table 3 shows the results of ranking features from the NSL-KDD dataset.