###### Abstract  
Network traffic classification models, an essential part of intrusion detection systems, need to be as simple as possible due to the high speed of network transmission. One of the fastest approaches is based on decision trees, where the classification process requires a series of tests, resulting in a class assignment. In the network traffic classification process, these tests are performed on extracted traffic features. The classification computational efficiency grows when the number of features and their tests in the decision tree decreases. This paper investigates the relationship between the number of features used to construct the decision-tree-based intrusion detection model and the classification quality. This work deals with a reference dataset that includes IoT/IIoT network traffic. A feature selection process based on the aggregated rank of features computed as the weighted average of rankings obtained using multiple (in this case, six) classifier-based feature selectors is proposed. It results in a ranking of 32 features sorted by importance and usefulness in the classification process. In the outcome of this part of the study, it turns out that acceptable classification results for the smallest number of best features are achieved for the eight most important features at \(-95.3\%\) accuracy. In the second part of these experiments, the dependence of the classification speed and accuracy on the number of most important features taken from this ranking is analyzed. In this investigation, optimal times are also obtained for eight or fewer number of the most important features, e.g., the trained decision tree needs \(0.95\) s to classify nearly \(7.6\) million samples containing eight network traffic features. The conducted experiments prove that a subset of just a few carefully selected features is sufficient to obtain reasonably high classification accuracy and computational efficiency. Keywords:cybersecurity; Internet of Things; machine learning for cybersecurity; intrusion detection systems; decision trees; network traffic features; ensemble feature selection +
Footnote †: journal: Medical  
forces an appropriate processing speed--the classifiers in this domain must be fast and able to finally run in real-time. This--in turn--requires the optimization of all the aspects of the traffic classifier: the number of features used, the classification algorithm, and its implementation. In this paper, the problem of choosing the smallest possible set of traffic features and preserving high classification accuracy is discussed. Such features are then ready for the classifier to use, e.g., the fast decision-tree model. This investigation proposes a rank aggregation approach based on the ensemble approach employing multiple methods: random forests, extra trees, adaboost, passive aggressive algorithm, support vector machine, and ridge classifier. They are used as feature selectors, producing a list of features sorted by relevance (ranked list). To combine the ranks produced by various methods, a linear combination of ranks with accuracies of appropriate classifiers are used as weights--the latter results in the aggregated ranking of features. By simple rank thresholding, one can then obtain the set of features that can be applied to train the classifier, the quality of which depends on the number of features chosen. Three classic measures are used to measure the quality: accuracy, precision, and recall. Feature selection has been widely used for a variety of research problems, from blood composition analysis to checking text in emails, up to processing images containing fingerprints [5]. Another application of feature selection is its use for processing network traffic for IDS purposes [6] as this work performs. In this investigation, the combination of three decision-tree-based and three linear classifiers is used to perform feature aggregation in their selection process.