Feature Selection For Intrusion Detection Research Articles

Feature Selection for Intrusion Detection Using Independence Level Test with an Exhaustive Approach

Feature Selection for Intrusion Detection Using Independence Level Test with an Exhaustive Approach

A novel hybrid autoencoder and modified particle swarm optimization feature selection for intrusion detection in the internet of things network

The Internet of Things (IoT) represents a paradigm shift in which the Internet is connected to real objects in a range of areas, including home automation, industrial processes, human health, and environmental monitoring. The global market for IoT devices is booming, and it is estimated that there will be 50 billion connected devices by the end of 2025. This explosion of IoT devices, which can be expanded more easily than desktop PCs, has led to an increase in cyber-attacks involving IoT devices. To address this issue, it is necessary to create novel approaches for identifying attacks launched by hacked IoT devices. Due to the possibility that these attacks would succeed, Intrusion Detection Systems (IDS) are required. IDS' feature selection stage is widely regarded as the most essential stage. This stage is extremely time-consuming and labor-intensive. However, numerous machine learning (ML) algorithms have been proposed to enhance this stage to boost an IDS's performance. These approaches, however, did not produce desirable results in terms of accuracy and detection rate (DR). In this paper, we propose a novel hybrid Autoencoder and Modified Particle Swarm Optimization (HAEMPSO) for feature selection and deep neural network (DNN) for classification. The PSO with modification of inertia weight was utilized to optimize the parameters of DNN. The experimental analysis was performed on two realistic UNSW-NB15 and BoT-IoT datasets that are suitable for IoT environment. The findings obtained by analyzing the proposed HAEMPSO against the Generic attack in the UNSW-NB15 dataset gave an accuracy of 98.8%, and a DR of 99.9%. While the benign class revealed an accuracy of 99.9% and DR of 99.7%. In the BoT-IoT dataset, the DDoS HTTP attack revealed an accuracy of 99.22% and DR of 97.79%. While the benign class gave an accuracy of 97.54% and DR of 97.92%. In comparison with the state-of-the-art machine learning schemes, our proposed HAEMPSO-DNN achieved a competitive feat in terms of DR and accuracy.

Heuristic Initialization Using Grey Wolf Optimizer Algorithm for Feature Selection in Intrusion Detection

Heuristic Initialization Using Grey Wolf Optimizer Algorithm for Feature Selection in Intrusion Detection

Multi-objective PSO based feature selection for intrusion detection in IoT based wireless sensor networks

Internet of Things (IoT) utilization is increasing every day in both industry and other applications recently. However, the IoT communication is under security threats from malicious users. In spite of the availability of multiple security solutions in the literature, the intruders are targeting the IoT sensor networks through multiple type of attacks. Therefore, an effective Intrusion Detection System (IDS) is required for safe-guarding the communication in the IoT environment. For this purpose, we propose an Intelligent Intrusion Detection System for detecting intruders in IoT based wireless sensor networks so that it is possible to handle such intrusions. For the development of this intelligent IDS, we propose a rule and Multi-Objective PSO based feature selection algorithm and also propose an intelligent rule based enhanced Multiclass Support Vector Machines classification algorithm for detecting the intruders more accurately. From the experiments conducted in this work by using KDD’99 Cup data set and CIDD data set for evaluation, it is proved that the proposed IDS is able to capture the intruders more accurately by enhancing the detection accuracy and also by reducing the false positive rate.

An extended assessment of metaheuristics-based feature selection for intrusion detection in CPS perception layer

An extended assessment of metaheuristics-based feature selection for intrusion detection in CPS perception layer

A Multi-level Correlation-Based Feature Selection for Intrusion Detection

A Multi-level Correlation-Based Feature Selection for Intrusion Detection

Analysis of Machine Learning Algorithms with Feature Selection for Intrusion Detection using UNSW-NB15 Dataset

In recent times, various machine learning classifiers are used to improve network intrusion detection. The researchers have proposed many solutions for intrusion detection in the literature. The machine learning classifiers are trained on older datasets for intrusion detection, which limits their detection accuracy. So, there is a need to train the machine learning classifiers on the latest dataset. In this paper, UNSW-NB15, the latest dataset is used to train machine learning classifiers. The selected classifiers such as K-Nearest Neighbors (KNN), Stochastic Gradient Descent (SGD), Random Forest (RF), Logistic Regression (LR), and Naïve Bayes (NB) classifiers are used for training from the taxonomy of classifiers based on lazy and eager learners. In this paper, Chi-Square, a filter-based feature selection technique, is applied to the UNSW-NB15 dataset to reduce the irrelevant and redundant features. The performance of classifiers is measured in terms of Accuracy, Mean Squared Error (MSE), Precision, Recall, F1-Score, True Positive Rate (TPR) and False Positive Rate (FPR) with or without feature selection technique and comparative analysis of these machine learning classifiers is carried out.

Optimal feature selection in intrusion detection using SVM-CA

Feature selection plays a vital role in toning down the effects of the curse of dimensionality in the humungous datasets seen in intrusion detection. Feature selection algorithms are used to pick the relevant features and averts the extraneous and repeated features from the dataset to improve the efficiency. It can reduce processing time, dimension of data and enhance the performance of the system in terms of precision and training time. This paper proposes a novel variant of support vector machine, known as SVM correlation algorithm (SVM-CA) to choose the relevant features. The combination of SVM with correlation algorithm enhances the classification accuracy. Our proposed SVM-CA algorithm deals with the problems faced by the existing algorithm like low accuracy and high detection time. The performance of the algorithm is appraised by five parameters including the modelling time, true positive rate (TPR), false positive rate (FPR) and accuracy. The experimental results show that our proposed technique decreases the false positive rate and processing time.

Analysis of Machine Learning Algorithms with Feature Selection for Intrusion Detection Using UNSW-NB15 Dataset

In recent times, various machine learning classifiers are used to improve network intrusion detection. The researchers have proposed many solutions for intrusion detection in the literature. The machine learning classifiers are trained on older datasets for intrusion detection, which limits their detection accuracy. So, there is a need to train the machine learning classifiers on the latest dataset. In this paper, UNSW-NB15, the latest dataset is used to train machine learning classifiers. The selected classifiers such as K-Nearest Neighbors (KNN), Stochastic Gradient Descent (SGD), Random Forest (RF), Logistic Regression (LR), and Naive Bayes (NB) classifiers are used for training from the taxonomy of classifiers based on lazy and eager learners. In this paper, Chi-Square, a filter-based feature selection technique, is applied to the UNSW-NB15 dataset to reduce the irrelevant and redundant features. The performance of classifiers is measured in terms of Accuracy, Mean Squared Error (MSE), Precision, Recall, F1-Score, True Positive Rate (TPR) and False Positive Rate (FPR) with or without feature selection technique and comparative analysis of these machine learning classifiers is carried out.

Optimal feature selection in intrusion detection using SVM-CA

Optimal feature selection in intrusion detection using SVM-CA

A multi-objective immune algorithm for intrusion feature selection

Feature selection plays a crucial role in classification problems, which tries to remove redundant or irrelevant features by mapping high-dimensional data to low-dimensional ones. Thus, this approach can improve the classification accuracy and reduce the computational cost to train the classification model. In this paper, we suggest an improved multi-objective immune algorithm (MOIA) for feature selection in intrusion detection. Specifically, the feature subsets for intrusion detection are treated as the individuals for immune optimization, which will select suitable feature subsets in order to reduce the dimensions of the dataset. After that, a neural network is used to train the classification model using the selected suitable feature subsets, and the output of the classification model is regarded as the target fitness value for each individual. As multiple attack types are considered in this paper, a traditional MOIA is modified by using an elite selection strategy based on the reference vectors, which can maintain the individuals with more promising performance when distinguishing more than five attack types in intrusion detection. By this way, the proposed algorithm can accelerate the convergence speed of classification, which also improves the classification accuracy. Experimental results on the NSL-KDD and UNSW-NB15 datasets validate the higher classification accuracy of the proposed algorithm.

Towards Improved Random Forest based Feature Selection for Intrusion Detection in Smart IOT Environment

of Things (IoT) is raised as most adaptive technologies for the end users in past few years. Indeed of being popular, security in IoT turned out to be a crucial research challenge and a sensible topic which is discussed very often. Denial of Service (DoS) attack is encountered in IoT sensor networks by perpetrators with numerous compromised nodes to flood certain targeted IoT device and thus resulting in vulnerability or service unavailability. Features that are encountered from the malicious node can be utilized effectually to recognize recurring patterns or attack signature of network based or host based attacks. Henceforth, feature extraction using machine learning approaches for modelling of Intrusion detection system (IDS) have been cast off for identification of threats in IoT devices. In this investigation, Kaggle dataset is measured as benchmark dataset for detecting intrusion is considered initially. These dataset includes 41 essential attributes for intrusion identification. Next, selection of features for classifiers is done with an improved Weighted Random Forest Information extraction (IW-RFI). This proposed WRFI approach evaluates the mutual information amongst the attributes of features and select the optimal features for further computation. This work primarily concentrates on feature selection as effectual feature selection leads to effectual classification. Finally, performance metrics like accuracy, sensitivity, specificity is computed for determining enhanced feature selection. The anticipated model is simulated in MATLAB environment, which outperforms than the existing approaches. This model shows better trade off in contrary to prevailing approaches in terms of accurate detection of threats in IoT devices and offers better transmission over those networks.

Feature selection for intrusion detection using new multi-objective estimation of distribution algorithms

The manipulation of a large number of features has become a critical problem in Intrusion Detection Systems(IDS). Therefore, Feature Selection (FS) is integrated to select the significant features, in order to avoid the computational complexity, and improve the classification performance. In this paper, we present a new multi-objective feature selection algorithm MOEDAFS (Multi-Objective Estimation of Distribution Algorithms (EDA) for Feature Selection). The MOEDAFS is based on EDA and Mutual Information (MI). EDA is used to explore the search space and MI is integrated as a probabilistic model to guide the search by modeling the redundancy and relevance relations between features. Therefore, we propose four probabilistic models for MOEDAFS. MOEDAFS selects the better feature subsets (non-dominated solutions) that have a better detection accuracy and smaller number of features. MOEDAFS uses two objective functions (minimizing classification Error Rate (ER) and minimizing the Number of Features(NF)). In order to demonstrate the performance of MOEDAFS, a comparative study is designed by internal and external comparison on NSL-KDD dataset. Internal comparison is performed between the four versions of MOEDAFS. External comparison is organized against some well-known deterministic, metaheuristic, and multi-objective feature selection algorithms that have a single and Multi-solution. Experimental results demonstrate that MOEDAFS outperforms recent algorithms.

Applying an Improved Elephant Herding Optimization Algorithm with Spark-based Parallelization to Feature Selection for Intrusion Detection

Applying an Improved Elephant Herding Optimization Algorithm with Spark-based Parallelization to Feature Selection for Intrusion Detection

Multivariate correlation coefficient and mutual information-based feature selection in intrusion detection

ABSTRACTFeature selection is one of the major problems in an intrusion detection system (IDS) since there are additional and irrelevant features. This problem causes incorrect classification and low detection rate in those systems. In this article, four feature selection algorithms, named multivariate linear correlation coefficient (MLCFS), feature grouping based on multivariate mutual information (FGMMI), feature grouping based on linear correlation coefficient (FGLCC), and feature grouping based on pairwise MI, are proposed to solve this problem. These algorithms are implementable in any IDS. Both linear and nonlinear measures are used in the sense that the correlation coefficient and the multivariate correlation coefficient are linear, whereas the MI and the multivariate MI are nonlinear. Least Square Support Vector Machine (LS-SVM) as an intrusion classifier is used to evaluate the selected features. Experimental results on the KDDcup99 and Network Security Laboratory-Knowledge Discovery and Data Mining (NSL) datasets showed that the proposed feature selection methods have a higher detection and accuracy and lower false-positive rate compared with the pairwise linear correlation coefficient and the pairwise MI employed in several previous algorithms.

A Multi-Objective Evolutionary Algorithm based Feature Selection for Intrusion Detection

A Multi-Objective Evolutionary Algorithm based Feature Selection for Intrusion Detection

Feature subset selection for intrusion detection using various rank-based algorithms

Feature selection in data mining enables the identification of significant features constituting the given data. It facilitates identification and isolation of profitable features to ensure quality in the underlying information. Feature selection achieves dimension reduction of data making mining tasks less complex. Ranker-based feature selection algorithms evaluate the features and generate a rank-list based on their score using which desirable features are identified to generate a subset. The various ranker algorithms include Relief-F, Information Gain, Gini Index, Correlation, and Minimum Redundancy Maximum Relevance. In this work, rankers have been used to perform feature selection for intrusion detection. Experiments have been carried out on the SSE Net 2011 data set and a machine learning classifier determines the accuracy of classification. Accuracy plots are generated and the threshold on the number of features to be selected is decided and substantial features in the data set are identified.

Feature subset selection for intrusion detection using various rank-based algorithms

Feature selection in data mining enables the identification of significant features constituting the given data. It facilitates identification and isolation of profitable features to ensure quality in the underlying information. Feature selection achieves dimension reduction of data making mining tasks less complex. Ranker-based feature selection algorithms evaluate the features and generate a rank-list based on their score using which desirable features are identified to generate a subset. The various ranker algorithms include Relief-F, Information Gain, Gini Index, Correlation, and Minimum Redundancy Maximum Relevance. In this work, rankers have been used to perform feature selection for intrusion detection. Experiments have been carried out on the SSE Net 2011 data set and a machine learning classifier determines the accuracy of classification. Accuracy plots are generated and the threshold on the number of features to be selected is decided and substantial features in the data set are identified.

Feature Selection for Intrusion Detection Using Random Forest

An intrusion detection system collects and analyzes information from different areas within a computer or a network to identify possible security threats that include threats from both outside as well as inside of the organization. It deals with large amount of data, which contains various ir-relevant and redundant features and results in increased processing time and low detection rate. Therefore, feature selection should be treated as an indispensable pre-processing step to improve the overall system performance significantly while mining on huge datasets. In this context, in this paper, we focus on a two-step approach of feature selection based on Random Forest. The first step selects the features with higher variable importance score and guides the initialization of search process for the second step whose outputs the final feature subset for classification and in-terpretation. The effectiveness of this algorithm is demonstrated on KDD’99 intrusion detection datasets, which are based on DARPA 98 dataset, provides labeled data for researchers working in the field of intrusion detection. The important deficiency in the KDD’99 data set is the huge number of redundant records as observed earlier. Therefore, we have derived a data set RRE-KDD by eliminating redundant record from KDD’99 train and test dataset, so the classifiers and feature selection method will not be biased towards more frequent records. This RRE-KDD consists of both KDD99Train+ and KDD99Test+ dataset for training and testing purposes, respectively. The experimental results show that the Random Forest based proposed approach can select most im-portant and relevant features useful for classification, which, in turn, reduces not only the number of input features and time but also increases the classification accuracy.

Comparative Study of Different Models before Feature Selection and AFTER Feature Selection for Intrusion Detection

A network data set may contain a huge amount of data and processing this huge amount of data is one of the most challenges task for network based intrusion detection system (IDS). Normally these data contain lots of redundant and irrelevant features. Feature selection approaches are used to extract the relevant features from the original data to improve the efficiency or accuracy of IDS. In this paper an effective feature selection approaches are used for the NSL KDD data set. The performance of the used classifiers measure and compared with each other. KEYWORDSselection, intrusion detection, NSL-KDD, Weka