What data features are typically extracted from network traffic in lightweight IoT for training DDoS intrusion detection models?

Given resource constraints, extracted features need to be simple and require minimal computation. Common features include: packet count per unit time, byte count per unit time, source/destination IP address entropy, port number entropy, inter-arrival time statistics, flag distribution (SYN, ACK, FIN, PSH), packet size statistics (mean, variance), protocol distribution (TCP, UDP, ICMP), and connection duration. These features aim to capture anomalies in traffic patterns characteristic of DDoS attacks without requiring deep packet inspection.