## 4 Experimental Results and Discussion
### Experimental Results and Analysis
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Feature**} & \multirow{2}{*}{**Approach**} & **Accuracy** & **Precision** & **Recall** & **F1-Measure** & **ROC Area** \\  & & **(\%)** & **(\%)** & **(\%)** & **(\%)** & **(\%)** & **(\%)** \\ \hline
**60** & IG-Ensemble & 99.81 & 99.80 & 99.80 & 99.80 & 98.50 \\
**60** & GR-Ensemble & 99.74 & 99.70 & 99.70 & 99.70 & 98.00 \\
**20** & IG-Ensemble & 99.73 & 99.70 & 99.70 & 99.70 & 97.90 \\
**20** & GR-Ensemble & 99.56 & 99.60 & 99.60 & 99.60 & 96.50 \\
**28** & UMF & 99.98 & 99.90 & 99.90 & 99.90 & 99.90 \\
**11** & IMF & 99.98 & 99.90 & 99.90 & 99.90 & 99.90 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Performance metrics of IoTID20 using ensemble with various selected features. Figure 6: Graphical representation of performance metrics of IoTIDS20 using ensemble with various selected feature sets. Figure 7: Graphical representation of performance metrics of NSL-KDD using ensemble with various selected features. Figure 8 shows the report of the confusion matrix of our proposed binary classification using the NSL-KDD benchmark dataset after the training / testing phase of five ML classifiers. The diagonal line of each confusion matrix reports the number of correctly classified instances, and reverse diagonal line reports the number of incorrectly classified instances. For instance, Figure 8 (box 1) shows the confusion matrix of the ANN with all features (41) considering attack or non-attack target. The 67,042 instances are classified correctly as an abnormal class whereas the 310 instances are classified incorrectly as an abnormal class. The 482 instances are classified incorrectly as a normal (non-attack) class whereas the 58,145 instances are classified correctly as a normal class. In regards to this particular experiment, using NSL-KDD with five ML classifiers, the confusion matrices demonstrate that our proposed feature selection approach (IMF and UMF) with any ML classifier is the most suitable model. Figure 9 shows the confusion matrix of the proposed model for multi-classification challenges using the five various ML classifiers with four FS approaches including our hybrid FS (proposed approach). We used IoTID20 dataset in this experiment. The main diagonal line reports the number of correct instances for each confusion matrix, and other cells represent the incorrect classification instances. For instance, Figure 8 (box 1) shows the classification results of ANN with top 60 ranked feature using IG approach. The 47,907 Mirai instances are classified correctly; 10 Mirai instances are predicted as DoS, 1289 Mirai instances are predicted as Scan, and 663 Mirai instances are predicted as MITM-ARP Spoofing. The 7040 DoS instances are predicted correctly; 52 DoS instances are wrongly classified as Mirai, 1 DoS instance is wrongly classified as Scan, and 7 DoS instances are wrongly classified as MITM-ARP Spoofing. The 8462 Scan instances are predicted correctly; \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Feature**} & \multirow{2}{*}{**Approach**} & \multirow{2}{*}{\begin{tabular}{c} **Accuracy** \\ **(\%)** \\ \end{tabular} } & \multirow{2}{*}{\begin{tabular}{c} **Precision** \\ **(\%)** \\ \end{tabular} } & \multirow{2}{*}{\begin{tabular}{c} **Recall** \\ **(\%)** \\ \end{tabular} } & \multirow{2}{*}{\
\begin{tabular}{c} **F1-Measure** \\ **(\%)** \\ \end{tabular} } & \multirow{2}{*}{
\begin{tabular}{c} **ROC Area** \\ **(\%)** \\ \end{tabular} } \\ \hline
**41** & ALL Feature & 99.66 & 99.7 & 99.7 & 99.7 & 99.6 \\
**20** & IG-Ensemble & 99.56 & 99.6 & 99.6 & 99.6 & 99.6 \\
**20** & GR-Ensemble & 99.56 & 99.6 & 99.6 & 99.91 & 100 \\
**25** & UMF & 99.80 & 99.8 & 99.8 & 99.8 & 100 \\
**15** & IMF & 99.80 & 99.8 & 99.8 & 99.8 & 100 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Performance metrics of NSL-KDD using ensemble with various selected features. Figure 8: Confusion matrix yielded by the five various models (2-classes) of NSL-KDD dataset.