A Multi-level Correlation-Based Feature Selection for Intrusion Detection

Prasad, Mahendra; Gupta, Rahul Kumar; Tripathi, Sachin

doi:10.1007/s13369-022-06760-2

Cited by 9 publications

(3 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our hybrid feature selection method obtains 23 important features and outperforms the standalone IG method or some other tree-based feature selection methods. It is worth mentioning that although our performance is lower than the 95.2% accuracy achieved by Prasad et al's work [27], it is because different studies use varying amounts of data for UNSW-NB15. Our study used the 10% pre-partitioned dataset from UNSW-NB15's author which is validated by statistical distributions, and our results are still competitive among similar methods.…”

Section: Comparisoncontrasting

confidence: 79%

See 1 more Smart Citation

IGRF-RFE: a hybrid feature selection method for MLP-based network intrusion detection on UNSW-NB15 dataset

et al. 2023

View full text Add to dashboard Cite

The effectiveness of machine learning models can be significantly averse to redundant and irrelevant features present in the large dataset which can cause drastic performance degradation. This paper proposes IGRF-RFE: a hybrid feature selection method tasked for multi-class network anomalies using a multilayer perceptron (MLP) network. IGRF-RFE exploits the qualities of both a filter method for its speed and a wrapper method for its relevance search. In the first phase of our approach, we use a combination of two filter methods, information gain (IG) and random forest (RF) respectively, to reduce the feature subset search space. By combining these two filter methods, the influence of less important features but with the high-frequency values selected by IG is more effectively managed by RF resulting in more relevant features to be included in the feature subset search space. In the second phase of our approach, we use a machine learning-based wrapper method that provides a recursive feature elimination (RFE) to further reduce feature dimensions while taking into account the relevance of similar features. Our experimental results obtained based on the UNSW-NB15 dataset confirmed that our proposed method can improve the accuracy of anomaly detection as it can select more relevant features while reducing the feature space. The results show that the feature is reduced from 42 to 23 while the multi-classification accuracy of MLP is improved from 82.25% to 84.24%.

show abstract

Section: Comparisoncontrasting

confidence: 79%

“…In Prasad et al 's work, a multi-level correlation-based feature selection was proposed in the intrusion detection systems on the UNSW-NB15 dataset [27]. In the two-level feature selection approach, Pearson correlation was used to evaluate feature-to-feature and feature-to-label correlations.…”

Section: Related Workmentioning

confidence: 99%

IGRF-RFE: a hybrid feature selection method for MLP-based network intrusion detection on UNSW-NB15 dataset

et al. 2023

View full text Add to dashboard Cite

show abstract

“…Prasad et al [34] proposed a feature selection method grounded in multi-level correlations that was tailored for network intrusion detection data. The suggested technique chooses significant features while reducing the size of the analyzed data.…”

Section: Literature Review Of Feature Selection Methods For Intrusion...mentioning

confidence: 99%

A Novel Feature Selection Approach to Classify Intrusion Attacks in Network Communications

Ozkan-Okay,

Samet,

Aslan

et al. 2023

Applied Sciences

View full text Add to dashboard Cite

The fast development of communication technologies and computer systems brings several challenges from a security point of view. The increasing number of IoT devices as well as other computing devices make network communications more challenging. The number, sophistication, and severity of network-related attacks are growing rapidly. There are a variety of different attacks including remote-to-user (R2L), user-to-remote (U2R), denial of service (DoS), distributed DDoS, and probing. Firewalls, antivirus scanners, intrusion detection systems (IDSs), and intrusion prevention systems (IPSs) are widely used to prevent and stop cyber-related attacks. Especially, IDPSs are used to stop and prevent intrusions on communication networks. However, traditional IDSs are no longer effective in detecting complicated cyber attacks from normal network traffic. Because of this, new promising techniques, which specifically utilize data mining, machine learning, and deep learning, need to be proposed in order to distinguish intrusions from normal network traffic. To effectively recognize intrusions, the feature generation, feature selection, and learning processes must be performed delicately before the classification stage. In this study, a new feature selection method called FSAP (Feature Selection Approach) is proposed. In addition, a hybrid attack detection model called SABADT (Signature- and Anomaly-Based Attack Detection Technique) is suggested, which utilizes different classification metrics to recognize attacks. The proposed general method FSACM (Feature Selection and Attack Classification Method) is tested on KDD ’99, UNSW-NB15, and CIC-IDS2017 datasets. According to the experiment results, the proposed method outperformed the state-of-the-art methods in the literature in terms of detection, accuracy, and false-alarm rates.

show abstract

Network intrusion detection via tri-broad learning system based on spatial-temporal granularity

Zhang

Liu

et al. 2023

J Supercomput

View full text Add to dashboard Cite

Network intrusion detection system plays a crucial role in protecting the integrity and availability of sensitive assets. Network traffic data contains a large amount of time, space, and statistical information. Existing research lacks the utilization of spatial-temporal multi-granularity data features and the mutual support among different data features, thus making it difficult to specifically and accurately identify anomalies. Taking into account the distinctions among different granularities, we propose a framework called Tri-Broad Learning System (TBLS), which can learn and integrate the three granular features. In order to accurately explore the spatial-temporal connotation of the traffic information, a feature dataset containing three granularities is constructed according to the characteristics of time, space, and data content. In this way, we use broad learning basic units to extract abstract features of different granularities, and then express these features in different feature spaces to enhance them separately. We use the "He" instead of the original initialization method in BLS to initialize the weights of feature nodes and enhancement nodes to achieve better detection accuracy. We exhibit the merits of our proposed model on the UNSW-NB15, CIC-IDS-2017, and mixed traffic datasets. Experimental JOURNAL OF SUPERCOMPUTING results show that TBLS outperforms the typical BLS in terms of various evaluation metrics and time consumption. Compared with other machine learning methods, TBLS achieves better performance metrics.

show abstract

A Multi-level Correlation-Based Feature Selection for Intrusion Detection

Cited by 9 publications

References 25 publications

IGRF-RFE: a hybrid feature selection method for MLP-based network intrusion detection on UNSW-NB15 dataset

IGRF-RFE: a hybrid feature selection method for MLP-based network intrusion detection on UNSW-NB15 dataset

A Novel Feature Selection Approach to Classify Intrusion Attacks in Network Communications

Network intrusion detection via tri-broad learning system based on spatial-temporal granularity

Contact Info

Product

Resources

About