Building an Intrusion Detection System Using a Filter-Based Feature Selection Algorithm

Mohammed A Ambusaidi,Priyadarsi Nanda,Xiangjian He,Zhiyuan Tan

doi:10.1109/tc.2016.2519914

Abstract

Redundant and irrelevant features in data have caused a long-term problem in network traffic classification. These features not only slow down the process of classification but also prevent a classifier from making accurate decisions, especially when coping with big data. In this paper, we propose a mutual information based algorithm that analytically selects the optimal feature for classification. This mutual information based feature selection algorithm can handle linearly and nonlinearly dependent data features. Its effectiveness is evaluated in the cases of network intrusion detection. An Intrusion Detection System (IDS), named Least Square Support Vector Machine based IDS (LSSVM-IDS), is built using the features selected by our proposed feature selection algorithm. The performance of LSSVM-IDS is evaluated using three intrusion detection evaluation datasets, namely KDD Cup 99, NSL-KDD and Kyoto 2006+ dataset. The evaluation results show that our feature selection algorithm contributes more critical features for LSSVM-IDS to achieve better accuracy and lower computational cost compared with the state-of-the-art methods.

Highlights

D ESPITE increasing awareness of network security, the existing solutions remain incapable of fully protecting internet applications and computer networks against the threats from ever-advancing cyber attack techniques such as DoS attack and computer malware
The classification performance of the intrusion detection model combined with Flexible Mutual Information Feature Selection (FMIFS), MIFS (β = 0.3), MIFS (β = 1) and Flexible Linear Correlation Coefficient based Feature Selection (FLCFS) and the model using all features based on the three datasets are shown in Table 2 and Figure 2
It shows clearly that the detection model combined with the FMIFS has achieved an accuracy rate of 99.79%, 99.91% and 99.77% for KDD Cup 99, NSL-KDD and Kyoto 2006+, respectively, and significantly

Summary

Introduction

D ESPITE increasing awareness of network security, the existing solutions remain incapable of fully protecting internet applications and computer networks against the threats from ever-advancing cyber attack techniques such as DoS attack and computer malware. The traditional security techniques, as the first line of security defence, such as user authentication, firewall and data encryption, are insufficient to fully cover the entire landscape of network security while facing challenges from ever-evolving intrusion skills and techniques [1]. Another line of security defence is highly recommended, such as Intrusion Detection System (IDS). An IDS alongside with anti-virus software has become an important complement to the security infrastructure of most organizations. The combination of these two lines provides a more comprehensive defence against those threats and enhances network security

Methods

Results

Conclusion