# Enhancing IoT Network Security Using Feature Selection for Intrusion Detection Systems
## 5 Discussion
### Fwd Init Window Size and Its Role in Detecting SYN Flood and TCP-Based Attacks  
The results of this study, as highlighted in the correlation coefficient heatmap, identified 'fwd_init_window_size' as one of the key features strongly correlated with SYN flood attacks. This finding emphasizes the importance of this parameter in detecting TCP-based threats, particularly in IoT environments. By uncovering this correlation, our analysis validates the role of 'fwd_init_window_size' as a critical metric for identifying those anomalies associated with these types of cyberattacks.  
A SYN flood attack is a form of TCP-based attack in which 'fwd_init_window_size' is a critical parameter. This parameter represents the initial size of the transmission window allocated by the server for incoming connections. SYN flood attacks lead to the manipulation of this feature. Specifically, a large number of SYN requests are sent to the server without completing a TCP handshake, thus leading to the consumption of server resources and resulting in denial of service [39]. Along with the manipulation of the size of the initial window, the server becomes preoccupied with the task of managing the flood of incomplete connections, thus disabling its ability to handle legitimate traffic. Thus, via SYN flood attacks, the attacker exhausts the server's resources by exploiting the handshake mechanism of the TCP protocol [40]. 'fwd_init_window_size' is a prime example of the vulnerabilities found in IoT devices, which are frequently resource-constrained and rely on efficient communication with the network. For attackers who disrupt services by manipulating TCP parameters, IoT devices are particularly susceptible [41]. If an anomaly related to the 'fwd_init_window_size' parameter is detected, it could serve as a warning of various attacks, such as SYN flood attacks and several other TCP-based threats.  
Recently developed detection systems are based on several deep learning models, such as CNN-GRU. These systems can analyze several patterns in network traffic and detect attacks in real time, based on deviations identified in the initial size of the window [41]. By exploiting these deviations, the detection accuracy of UDP Lag and SYN flood attacks has been enhanced by machine learning concepts, such as the AdaBoost algorithm [39]. The process of detecting SYN flood attacks may be further enhanced by considering several changes in the patterns of network traffic. These changes can be identified by entropy-based analysis in the hybrid environments of SDE, as in the case of SynFloWatch, including changes related to the initial size of the window [42].  
Overall, 'fwd_init_window_size' is useful for detecting vulnerabilities in IoT networks. The values of the size parameter can be monitored to recognize an ongoing attack, based on unusual traffic patterns. Both the integrity and availability of services can be ensured by fortifying IoT networks against TCP-based attacks by employing machine learning and deep learning techniques [42]. To prevent several sophisticated attacks, such as off-path TCP hijacking, comprehensive security measures are required to consider all aspects of TCP communication, including the initial window size [43]. Moreover, packet size variations may be exploited in Wi-Fi networks via side-channel attacks. Ultimately, the manipulation of 'Fwd Init Window Size' can lead to significant disruptions in IoT services; thus, it acts as an important indicator of the effects of SYN flood and other TCP-based attacks. This feature can be integrated into detection and mitigation strategies, and the resilience of IoT devices against such threats can be enhanced by network administrators to ensure robustness and security in network operations [40].