# Enhancing IoT Network Security Using Feature Selection for Intrusion Detection Systems
## 3 Materials and Methods  
### Description of the Datasets and Methods  
An open-source dataset, namely, RT-IoT2022, which is accessible via the UCI Machine Learning Repository [11], was used in this research. A large amount of network traffic data was derived from various real-time IoT devices such as Amazon Alexa ([[https://alexa.amazon.com](https://alexa.amazon.com)]([https://alexa.amazon.com](https://alexa.amazon.com)), accessed on 15 October 2024) and MQTT ([[https://mqtt.org](https://mqtt.org)]([https://mqtt.org](https://mqtt.org)), accessed on 15 October 2024) to generate the dataset. The dataset captures the complexity involved in network traffic via 83 input features and an output feature determining the type of attack. The count of instances in the dataset is 123,117, each of which is classified as either normal or abnormal, and the attack pattern is identified for the abnormal cases. Several attack patterns have been captured, namely, address resolution protocol poisoning, denial-of-service (DoS) SYN Hping, brute-force SSH, Slowloris distributed denial-of-service (DDoS), and five different Nmap patterns. Because the RT-IoT2022 dataset provides comprehensive information about several factors related to IDSs, it is a valuable resource for developing a robust solution to security concerns [26]. Herein, a network identification model is proposed to identify the most important variables related to the IoT domain. As one of the important steps in the task of building the model, the dataset is first preprocessed and then cleaned to enhance performance. Several preprocessing methods were executed to check for missing values and to determine the appropriate format for each data type. For this paper, an exhaustive feature screening process was deployed to recognize the most common predictors in IoT-based threat prediction. The proposed approach can be summarized into four main steps, as illustrated in Figure 1:  
* Finding feature importance: here, we harnessed the power of five distinct feature selection methods to ensure a robust and comprehensive feature elimination process. The selected methods were information gain, correlation-based feature subset selection (CFS), the gain ratio, symmetrical uncertainty, and Pearson's analysis. These algorithms are among the most popular feature selection algorithms and are used in many areas [27; 28]. For each method, an importance score was generated for each feature. Finally, a comparison between feature selection techniques in terms of execution time, search method, and attribute evaluator was performed. * Investigating the effect of thresholds and the number of features: here, we used the feature importance scores from each method (obtained in the previous step) to set different threshold values (cutoffs), which included different sets of features that contributed to a certain percentage of the total feature importance. For each feature selection method, the multi-layer perceptron (MLP) classifier was employed, using different sets of features and threshold values. We then compared the model performance with different numbers of features to find the optimal cutoff. The MLP classifier is a neural network model that processes data through interconnected layers, utilizing non-linear transformations to solve complex tasks. * Combining features generated from different feature selection methods: here, we used a frequency-based approach to retain the features that appeared in \(\geq\) four feature selection methods. The most frequently occurring features were selected, and linear relationships were measured to determine the correlation coefficient. A reduced set of features is then generated in this step. * Examining the effect of the reduced set of features in enhancing IoT network security: here, we employed an MLP classifier on both datasets (a full feature set and the reduced set generated in this study) to test whether the proposed feature selection methods can enhance the accuracy and efficiency of the classifier.