A Review on Feature Selection and Ensemble Techniques for Intrusion Detection System

Abstract

Intrusion detection has drawn considerable interest as researchers endeavor to produce efficient models that offer high detection accuracy. Nevertheless, the challenge remains in developing reliable and efficient Intrusion Detection System (IDS) that is capable of handling large amounts of data, with trends evolving in real-time circumstances. The design of such a system relies on the detection methods used, particularly the feature selection techniques and machine learning algorithms used. Thus motivated, this paper presents a review on feature selection and ensemble techniques used in anomaly-based IDS research. Dimensionality reduction methods are reviewed, followed by the categorization of feature selection techniques to illustrate their effectiveness on training phase and detection. Selection of the most relevant features in data has been proven to increase the efficiency of detection in terms of accuracy and computational efficiency, hence its important role in the design of an anomaly-based IDS. We then analyze and discuss a variety of IDS-based machine learning techniques with various detection models (single classifier-based or ensemble-based), to illustrate their significance and success in the intrusion detection area. Besides supervised and unsupervised learning methods in machine learning, ensemble methods combine several base models to produce one optimal predictive model and improve accuracy performance of IDS. The review consequently focuses on ensemble techniques employed in anomaly-based IDS models and illustrates how their use improves the performance of the anomaly-based IDS models. Finally, the paper laments on open issues in the area and offers research trends to be considered by researchers in designing efficient anomaly-based IDSs.

A Deep Learning-Based Framework for Feature Extraction and Classification of Intrusion Detection in Networks

“…Feature selection is considered one of the main parts of IDS because these systems have to deal with a large amount of data so a strong feature reduction technique is always encouraged to be applied with the network classification problem. Researchers [34,[36][37][38][39][40][41][42][43][44][45][46][47][48][49][50][51][52] have used different feature selection techniques. The gain ratio, Pearson correlation, and ANOVA are few of the techniques that are widely used.…”

Impact of Feature Selection Methods on Machine Learning-based for Detecting DDoS Attacks : Literature Review

“…Ini lebih efisien dalam memperkenalkan pola paket, tetapi untuk mendeteksi bentuk ancaman dan varian baru, pertama-tama harus diperkenalkan ke system (Moustafa & Slay, 2016). Deteksi Anomali Teknik pendeteksian ini lebih berfokus pada trafik jaringan (Torabi et al, 2021). Keuntungan dari teknik ini adalah lebih cepat untuk mengetahui serangan baru tetapi tidak memberikan informasi yang jelas tentang dampak dari serangan tersebut.…”

Hybrid Feature Selection Method for Intrusion Detection Systems Based on an Improved Intelligent Water Drop Algorithm

“…IDS can be classified into four categories depending on the detection method, where detection systems may depend on signature, anomaly, specification, or hybrid detection methods [7]. In the first category, detecting an abnormal behaviour is achieved by using well-known patterns (signatures) for the previous threats in the database [8].…”

“…In the first category, detecting an abnormal behaviour is achieved by using well-known patterns (signatures) for the previous threats in the database [8]. When it comes to well-known, popular threats, this category provides better performance and very strong outcomes, but it is unable to identify the new unseen attacks or the zero-day attacks [7].…”

“…In other words, an anomaly is a data point or odd observed data that is too far apart from other data points in a dataset. This type can detect previously undiscovered attack incidents, but the percentage of activities that have been wrongly defined as attacks is typically high [7,9].…”