# Enhancing IoT Network Security Using Feature Selection for Intrusion Detection Systems
## 4 Results
Referring to the feature selection outcomes across the techniques, the data from the algorithms indicated that the optimal number of predictor variables varies between the different algorithms. The number of features was reduced using CFS, [PERSON]'s analysis, the gain ratio, information gain, and symmetrical uncertainty to 5, 32, 51, 45, and 60, respectively. A comparison between the feature selection techniques in terms of execution time, search method, and attribute evaluator is shown in Table 2. The run-time of these algorithms on the dataset ranges between 1.2 and 13.3 s.  
Delving into the feature importance within different feature selection techniques, the feature 'fwd_init_window_size' was the most important for predicting network behavior and appeared in all feature selection techniques. Fifteen other features also had relatively high importance, appearing in the reduced set of features of at least four methods. These features are shown in Table 3. Furthermore, the gain ratio, information gain, and symmetric uncertainty captured the same set of high-importance features. These features were then used for classification to test the usefulness of this process. In addition, although 'IDLE' features, such as 'Idle.avg', 'idle.max', 'idle.min', 'idle.std', and 'idle.tot', appeared in some feature selection methods ([PERSON]'s analysis and the gain ratio), they had relatively low importance, indicating low correlations with predicting network behavior. Moreover, seven features did not appear in any of the feature selection methods, namely, 'fwd_bulk_rate', 'fwd_URG_flag_count', 'fwd_bulk_packets', 'flow_CWR_flag_count', 'bwd_bulk_rate', 'fwd_bulk_bytes', and 'flow_ECE_flag_count', which suggests that these features do not contribute to predicting network behavior. Then, the correlation coefficients were determined based on the linear relationships between the most important features (16 features) and the class (attack type). We evaluated the correlation coefficients among the data, as presented in Figure 6. This correlation matrix shows that there are significant correlations between most of the features. The results suggest that 'id.resp_p','service', 'fwd_init_window_size', and 'flow_SYN_flag_count' are the principal contributors to 'attack type', with scores of 0.41, 0.4, 0.37, and 0.37, respectively. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Feature Selection** & **Search Method** & **Attribute Evaluator** & **Time (s)** & **Number of Features** \\ \hline CFS & Best first & CFS subset evaluator & 13.3 & 5 \\ \hline Pearson’s analysis & Attribute ranking & Correlation ranking filter & 1.2 & 32 \\ \hline Gain ratio & Attribute ranking & Gain ratio feature evaluator & 9.75 & 51 \\ \hline Information gain & Attribute ranking & Information gain ranking filter & 9.24 & 45 \\ \hline Symmetrical uncertainty & Attribute ranking &
\begin{tabular}{c} Symmetrical uncertainty \\ ranking filter \\ \end{tabular} & 10.02 & 60 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Comparative analysis of feature selection techniques. Moreover, we assessed the use of 16 features, generated using a combination of feature selection methods with the MLP classifier, and compared the results with those when deploying the reduced set of features generated by each feature selection method and the full set of features (83 features) with the same classifier. To perform the experiments, each dataset was initially partitioned: 70% was used as a training set and 30% as a testing set. All performance metrics, including accuracy, precision, recall, and F1-score, were stated as percentages. Table 4 shows the performance of the approaches. The results of the experiment demonstrated the impact of feature selection on the accuracy of the MLP classifier.