## 3 Methodology  
### Dataset Description  
This study uses a publicly available dataset CICDDOS2019 [47] comprising network attack data. The dataset has a total of 88 features. It attempts to capture network communication by including details such as source and destination IP addresses, port numbers, type of protocol, time stamps, length of a flow, length of packets, and a few statistical metrics related to inter-arrival times and sizes of packets. These features provide a detailed view of network traffic, allowing us to identify unusual patterns that could indicate DDoS attacks. The CICDDoS2019 dataset, although not originally developed for the Internet of Vehicles (IoV) context, has recently been widely used in various IoV-related works to simulate and analyze different DDoS attack scenarios. This dataset includes a broad range of DDoS attack patterns, including IP/UDP-based traffic, which is very similar to IoV communications such as V2V and V2I systems. This dataset has been used in studies [45; 46] that investigate the effects of DDoS attacks on IoV networks and, therefore, prove useful for IoV-specific issues. The various steps used to make data suitable for model training include the following:  
1. Data Preprocessing: First, we cleaned the dataset for model training, handled missing values, and transformed categorical variables. Mean imputation was applied to numerical features, while mode imputation was performed on categorical features. One-hot encoding was used for features with a small number of categories, whereas features with a high number of categories were encoded using a label encoder to ensure the data were complete and ready for training. 2. Feature Importance Calculation: We used a Random Forest classifier to calculate the Gini importance scores of all features. Random Forest creates many decision trees and then averages their results for better accuracy and to avoid fitting. 3. Feature Selection: We picked the top 25 features with the highest Gini importance score, reducing model complexity and retaining only those that are informative. The following formula is used to obtain the Gini index for a feature \(X\): \[Gini(X)=1-\sum_{i=1}^{n}p_{i}^{2}\] (1) where \(p_{i}\) is the probability of class \(i\) in the dataset. Table 2 tells the list of 25 key features and their data types used in our analysis. These features are very useful in comprehending and fully analyzing the network traffic. The data types used are integers (int64), floating-point numbers (float64), and object types. Each feature, like the source and destination ports, is very useful in aiding our study. As shown in Figure 3, features like \"Source Bytes\" and \"Destination Bytes\" have the highest Gini scores, which highlight their importance for classification. These key features capture transmission patterns, simplify decision boundaries, and improve model performance. Table 3 presents the attack statistics used in our study. More specifically, it details the different kinds of attacks encountered within the dataset, their total number of samples, and how these are split between the training and test sets. This information forms a critical background to understanding data distribution used for both training and testing our machine-learning models. The table indicates the prevalence of each attack type and guarantees that both training and test sets represent the real world.