A feature selection method based on neighbourhood rough set and genetic algorithm for intrusion detection

Abstract

In intrusion detection system, unsupervised clustering algorithm is often used to analyse the detected data without class labels, and judge them as the normal or abnormal behaviour. Optimal feature subset can cut down the computational time of the clustering algorithm and effectively improve the intelligibility and accuracy of the clustering result. Therefore, this paper put forward a feature selection algorithm based on neighbourhood rough set and genetic algorithm. Firstly, neighbourhood rough set model, expanding the equivalence relation of discrete space to that of continuous space, was improved from class average distance of decision attributes and attribute significance two aspects. Then, genetic algorithm was used to select optimal feature subset based on improved attribute significance. Finally, in order to verify the feasibility, experiments were done on KDD CUP 99, and the results showed that the feature subset selected by the proposed algorithm ensured FCM getting higher accuracy.