Role of Feature Selection in Intrusion Detection Systems for 802.11 Networks

Abstract

Intrusion Detection Systems are important for protecting network and its resources from illegal penetration. For 802.11network, the features used for training and testing the intrusion detection systems consist of basic information related to the TCP/IP header, with no considerable attention to the features associated with lower level protocol frames. The resulting detectors were efficient and accurate in detecting network attacks at the network and transport layers, but unfortunately, not capable of detecting 802.11-specific attacks such as de authentication attacks or MAC layer DoS attack. IDS systems can also identify and alert to the presence of unauthorized MAC addresses on the networks. The IDS is based a novel hybrid model that efficiently selects the optimal set of features in order to detect 802.11-specific intrusions. This model for feature selection uses the information gain ratio measure as a means to compute the relevance of each feature and the k-means classifier to select the optimal set of MAC layer features that can improve the accuracy of intrusion detection systems while reducing the learning time of their learning algorithm.