Comparative Analysis of Feature Selection in Gradient Boosting Classification for Multiclass IoT Botnet Detection

In an Internet of Things (IoT) environment, botnet attacks that are part of normal activities result in variations in traffic patterns across classes, creating challenges for multiclass detection. Machine learning (ML)-based detection models rely heavily on high-dimensional traffic features, which can lead to high computational costs and limit the generalization of the built model. Previous research has discussed feature selection methods to address high-dimensional data using Filter and Wrapper methods. However, the study has not compared the results of the Filter and Wrapper methods with the Subset-based Correlation method. Therefore, this study aims to compare five feature selection methods grouped into three categories, namely Filter-based (MI and ANOVA), Subset-based Correlation (CFS), and Wrapper-based Methods (RFE and SFS). The novelty of this study lies in an in-depth comparative analysis of three groups of feature selection methods with a focus on the number of selected features. This study uses the selection results feature for botnet detection with the Gradient Boosting algorithm. The experiment was carried out using the N-BaIoT dataset, which contains 115 features and is split 80% for training and 20% for testing. The results of the experiment showed that the ANOVA method achieved a weighted average performance of up to 99.997% on the Accuracy, Precision, Recall, and F1-Score metrics by using 30 selected features. Meanwhile, the CFS method selected 4 features and achieved a weighted average performance of 99.989% across the Accuracy, Precision, Recall, and F1-Score metrics.