A Novel Feature Selection Approach for Intrusion Detection Data Classification

Abstract

Intrusion Detection Systems (IDSs) play a significant role in monitoring and analyzing daily activities occurring in computer systems to detect occurrences of security threats. However, the routinely produced analytical data from computer networks are usually of very huge in size. This creates a major challenge to IDSs, which need to examine all features in the data to identify intrusive patterns. The objective of this study is to analyze and select the more discriminate input features for building computationally efficient and effective schemes for an IDS. For this, a hybrid feature selection algorithm in combination with wrapper and filter selection processes is designed in this paper. Two main phases are involved in this algorithm. The upper phase conducts a preliminary search for an optimal subset of features, in which the mutual information between the input features and the output class serves as a determinant criterion. The selected set of features from the previous phase is further refined in the lower phase in a wrapper manner, in which the Least Square Support Vector Machine (LSSVM) is used to guide the selection process and retain optimized set of features. The efficiency and effectiveness of our approach is demonstrated through building an IDS and a fair comparison with other stateof-the-art detection approaches. The experimental results show that our hybrid model is promising in detection compared to the previously reported results.

Building an Intrusion Detection System Using a Filter-Based Feature Selection Algorithm

“…This helps the wrapper method (the lower phase) to decrease the searching range from the entire original feature space to the pre-selected features (the output of the upper phase). In this paper, we extend our work discussed in [10]. The key contributions of this paper are listed as follows.…”

“…To address the aforementioned problems on the methods for feature selection, we have proposed a hybrid feature selection algorithm (HFSA) in [10]. HFSA consists of two phases.…”

Hybrid feature selection technique for intrusion detection system

“…Another filter ranking was implemented by Ambusaidi et al (2014), who proposed hybrid feature selection by combining both mutual information (filter ranking) and wrapper that using least square-SVM as classification algorithm in removing irrelevant and redundant features. Mutual information provides a good measurement to find relevant feature by quantify the amount of information to the output class.…”

“…Nevertheless, achieving low false detection and high attack recognition capabilities is still a major challenge. There are three main differences in our approaches compared to existing hybrid selection (Ambusaidi et al, 2014;Singh and Tiwari, 2015). The first approach uses correlation-based selection to determine the worthiness of each feature by removes redundant features that exist inside filter rank.…”

Data Fusion for Network Intrusion Detection: A Review

“…In addition to efficiency, the validity is also an important measure of feature fusion techniques. For the KDD dataset series, SA-SVM [20], GA-LR [16], (Filter-MISF, FMIFS) [17], PCA [11], MIFS [24], (FRM-SFM, GFR) [18], SVM [9,10,19], (GeFS-mRMR, GeFS-CFS) [19], and NN [9] achieved very high accuracy, exceeding 99.20%, and the highest was 99.96% of SA-SVM. In addition, the FPR of Filter-MISF, GA-LR, Filter, MIFS, MLCFS [24], and SVM are less than 0.50%.…”