## 3 Proposed Architecture: Multi-Model IDS Based on Traffic Load
### Feature Selection  
To conduct ML experiments, it is necessary to evaluate the suitability of various feature selection techniques for different datasets within the field. In ML, feature selection is crucial to identifying the most relevant and informative features in the dataset. Selecting a subset of relevant features in the dataset allows us to improve ML models' performance, computational complexity, and interpretability [60]. The dataset's characteristics and specific ML task being performed are affected by which feature selection method will be applied in the dataset. The type of data, whether the data contain noise or irrelevant information, and the features' distribution all affect feature selection effectiveness [60]. There are two types of feature selection in this study, i.e., SelectKBest and VarianceThreshold:  
* Univariate feature selection: SelectKBest uses a statistical test to determine the top-K features. Many types of statistical tests are available, including chi-squared, F-tests, mutual information tests, and others. By selecting the first K features with the highest scores from the input dataset, SelectKBest retains them [61]. SelectKBest uses a univariate feature selection method to determine the strength of the relationship between a response variable and a feature. This method offers a greater understanding of data because of its simplicity and ease of use (though it could be optimized for better generalization because of the simplicity and ease of use of these methods). SelectKBest simplifies the modeling process when working with many features by identifying the most essential features needed to make accurate predictions [61]. * Removing features with low variance: In the VarianceThreshold algorithm, features with variances that do not meet a certain threshold are removed from the analysis. By default, all zero-variance features, which have the same value across all samples, are removed. Variance is typically calculated as the squared distance from the mean divided by the average squared value [62]. The variance of binary data (values of 0 and 1) can be calculated by using the following formula: \[Var[X]=p(1-p)\] (1) where \(p\) indicates the proportion of 1s in the dataset. The feature selection for the CIC-MalMem-2022 dataset and the CIC-IDS-2017 dataset was conducted by using SelectKBest, where K is 25 in the CIC-MalMem-2022 dataset and K is 30 in the CIC-IDS-2017 dataset. Assigning the value of K is determined by trying different values of K and then evaluating the model's performance. According to VarianceThreshold, the default value of 0 is recommended. This is because it is necessary to remove features with zero variance, and the CIC-IDS-2018 dataset contains a substantial number of features with zero variance. There are several benefits to using SelectKBest to select features for intrusion detection tasks. It is a simple, efficient, and effective technique that can enhance the performance of ML algorithms. Since the CIC-IDS-2018 dataset is complex, using VarianceThreshold to select features is preferable. It is an excellent choice for complex datasets because it is simple and efficient and can quickly identify high-variance subsets of features. All features with low variance are excluded from the CIC-IDS-2018 dataset. The threshold value for this experiment is 0. The dataset (features and target) was split into training data with a value of 80% and test data with a value of 20%. The datasets were significantly reduced in size from their original dimensions due to the application of data preprocessing and feature selection methods. Consequently, most of the CIC-MalMem-2022 data lacked relevance, redundancy, and accuracy. Thus, the CIC-MalMem-2022 dataset was reduced to 25, indicating that the remaining features were the most important for predictive modeling. Despite reducing the new samples to 32,713, a significant portion of the CIC-IDS-2018 dataset lacked variety, relevance, and accuracy.