Network Intrusion Detection Using Wrapper-based Decision Tree for Feature Selection

Umar, Mubarak Albarka; Chen, Zhanfang; Liu, Yan

doi:10.1145/3424311.3424330

Cited by 18 publications

(7 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…According to the authors of [78], the most commonly used evaluation metrics for the current intrusion detection models are Accuracy (ACC), Detection rate (DR), and FAR. However, the authors in [79] claimed that DR is the most crucial metric for IDS performance evaluation.…”

Section: Adopted Model Evaluation Metricsmentioning

confidence: 99%

Feature Selection and Ensemble-Based Intrusion Detection System: An Efficient and Comprehensive Approach

Jaw

Wang

2021

Symmetry

View full text Add to dashboard Cite

The emergence of ground-breaking technologies such as artificial intelligence, cloud computing, big data powered by the Internet, and its highly valued real-world applications consisting of symmetric and asymmetric data distributions, has significantly changed our lives in many positive aspects. However, it equally comes with the current catastrophic daily escalating cyberattacks. Thus, raising the need for researchers to harness the innovative strengths of machine learning to design and implement intrusion detection systems (IDSs) to help mitigate these unfortunate cyber threats. Nevertheless, trustworthy and effective IDSs is a challenge due to low accuracy engendered by vast, irrelevant, and redundant features; inept detection of all types of novel attacks by individual machine learning classifiers; costly and faulty use of labeled training datasets cum significant false alarm rates (FAR) and the excessive model building and testing time. Therefore, this paper proposed a promising hybrid feature selection (HFS) with an ensemble classifier, which efficiently selects relevant features and provides consistent attack classification. Initially, we harness the various strengths of CfsSubsetEval, genetic search, and a rule-based engine to effectively select subsets of features with high correlation, which considerably reduced the model complexity and enhanced the generalization of learning algorithms, both of which are symmetry learning attributes. Moreover, using a voting method and average of probabilities, we present an ensemble classifier that used K-means, One-Class SVM, DBSCAN, and Expectation-Maximization, abbreviated (KODE) as an enhanced classifier that consistently classifies the asymmetric probability distributions between malicious and normal instances. HFS-KODE achieves remarkable results using 10-fold cross-validation, CIC-IDS2017, NSL-KDD, and UNSW-NB15 datasets and various metrics. For example, it outclassed all the selected individual classification methods, cutting-edge feature selection, and some current IDSs techniques with an excellent performance accuracy of 99.99%, 99.73%, and 99.997%, and a detection rate of 99.75%, 96.64%, and 99.93% for CIC-IDS2017, NSL-KDD, and UNSW-NB15, respectively based on only 11, 8, 13 selected relevant features from the above datasets. Finally, considering the drastically reduced FAR and time, coupled with no need for labeled datasets, it is self-evident that HFS-KODE proves to have a remarkable performance compared to many current approaches.

show abstract

Section: Adopted Model Evaluation Metricsmentioning

confidence: 99%

Feature Selection and Ensemble-Based Intrusion Detection System: An Efficient and Comprehensive Approach

Jaw

Wang

2021

Symmetry

View full text Add to dashboard Cite

show abstract

“…Contaminated Features in Final Selection NSL-KDD [17] 2012 src bytes, service (metadata), dst bytes, dst host srv count, dst host same srv rate [18] 2015 src bytes, dst bytes, logged in, srv rerror rate [19] 2016 service, flag, src bytes, dst bytes [20] 2019 service, flag, src bytes, logged in [21] 2020 service, src bytes, flag [22] 2020 flag, logged in, service, dst host same srv rate, srv rerror rate, dst host srv count UNSW-NB-15 [18] 2015 state, dttl, sttl, ct state tll, ct srv dst, ct dst sport ltm [23] 2019 dttl [24] 2019 sttl, ct dst src ltm [25] 2020 dttl, ct srv src, ct dst sport ltm, ct dst src ltm, ct srv dst [26] 2022 sttl, ct state ttl, dsport (metadata)…”

Section: Yearmentioning

confidence: 99%

Discovering Non-Metadata Contaminant Features in Intrusion Detection Datasets

D’hooge

Verkerken

Wauters

et al. 2022

2022 19th Annual International Conference on Privacy, Security &Amp; Trust (PST)

View full text Add to dashboard Cite

Most newly proposed detection methods in intrusion detection incorporate machine learning models to distinguish between benign and malicious traffic. The models are validated on a handful of academic datasets and ranked based on their classification performance. This article aims to demonstrate that unbeknownst to the new models' authors, there are features in these datasets which heavily bias the results and obscure a realistic, reliable estimate of the separability of the datasets. This paper proposes a methodology to estimate the contaminating influence of a dataset's features based on the concept of blind generalization. The novel methodology is subsequently used to assess the features of six widely adopted intrusion detection datasets. In each dataset, several features show a pattern where regardless of training attack class, the models blindly generalize towards all available attack classes with nearly identical classification metrics. These features provide undeserved boosts in the baseline classification scores for each dataset. By themselves, some contaminant features even push these baselines upwards of 90% accuracy (balanced).

show abstract

“…Feature selection is widely used in many domains: intrusion detection, 25,26 genomic analysis, 27,28 text categorization, 29 and bioinformatics, 30 among others. As this work is an extension of our previous work, 31 a thorough review of the application of feature selection in intrusion detection can be found in the previous work. In this study, emphasis is given on the effectiveness and efficiency of the proposed feature selection approach in comparison to various feature selection methods.…”

Section: Feature Selectionmentioning

confidence: 99%

“…The embedded approach achieves model fitting and feature selection simultaneously, performing the feature selection during the learning time. 18 In this article, which is an extension of our previous work, 19 three more filter methods in addition to the wrapper method are compared. The wrapper-based feature selection with decision tree algorithm is first used as a regular means of obtaining an optimal subset of the original features.…”

Section: Introductionmentioning

confidence: 99%

A Hybrid Intrusion Detection with Decision Tree for Feature Selection

Umar¹,

Chen²,

Liu³

2021

ISIJ

Self Cite

View full text Add to dashboard Cite

Intrusion detection systems (IDS) typically take high computational complexity to examine data features and identify intrusion patterns due to the size and nature of the current intrusion detection datasets. Data pre-processing techniques (such as feature selection) are being used to reduce such complexity by eliminating irrelevant and redundant features in such datasets. The objective of this study is to analyse the effectiveness and efficiency of some feature selection approaches, namely wrapper-based and filter-based modelling approaches. To achieve that, machine learning models are designed in a hybrid approach with either wrapper or filter selection processes. Five machine learning algorithms are used on the wrapper and filter-based feature selection methods to build the IDS models using the UNSW-NB15 dataset. The wrapper-based hybrid intrusion detection model comprises a decision tree algorithm to guide the selection process and three filter-based methods, namely information gain, gain ratio, and relief, are used for comparison to determine the efficiency and effectiveness of the wrapper approach. Furthermore, a comparison with other state-of-the-art intrusion detection approaches is performed. The experimental results show that the wrapperbased method is quite effective in comparison to state-of-the-art works; however, it requires high computational time in comparison to the filter-based methods while achieving similar results. Our work also revealed unobserved issues on the conformity of the UNSW-NB15 dataset.

show abstract

Network Intrusion Detection Using Wrapper-based Decision Tree for Feature Selection

Cited by 18 publications

References 40 publications

Feature Selection and Ensemble-Based Intrusion Detection System: An Efficient and Comprehensive Approach

Feature Selection and Ensemble-Based Intrusion Detection System: An Efficient and Comprehensive Approach

Discovering Non-Metadata Contaminant Features in Intrusion Detection Datasets

A Hybrid Intrusion Detection with Decision Tree for Feature Selection

Contact Info

Product

Resources

About