Abstract:The revolutionary advances in network technologies have spearheaded the design of advanced cyberattacks to surpass traditional security defense with dreadful consequences. Recently, Intrusion Detection System (IDS) is considered as a pivotal element in network security infrastructures to achieve solid line of protection against cyberattacks. The prime challenges presented to IDS are curse of high dimensionality and class imbalance that tends to increase the detection time and degrade the efficiency of IDS. As a result, feature selection plays an important role in enabling to identify the most significant features for intrusion detection. Although, several feature evaluation measures are being proposed for feature selection in literature, there is no consensus on which measures are best for intrusion detection. Therein, this work aims at recommending the most appropriate feature evaluation measure for building an efficient IDS. In this direction, four filter-based feature evaluation measures that stem from different theories such as Consistency, Correlation, Information and Distance are investigated for their potential implications in enhancing the detection ability of IDS model for different classes of attacks. Along with this, the influence of the selected features on classification accuracy of an IDS model is analyzed using four different categories of classifiers namely, K-nearest neighbors (KNN), Random Forest (RF), Support Vector Machine (SVM) and Deep Belief Network (DBN). Finally, a two-step statistical significance test is conducted on the experimental results to determine which feature evaluation measure contributes statistically significant difference in IDS performance. All the experimental comparisons are performed on two benchmark intrusion detection datasets, NSL-KDD and UNSW-NB15. In these experiments, consistency measure has best influenced the IDS model in improving the detection ability with regard to detection rate (DR), false alarm rate (FAR), kappa statistics (KS) and identifying the most significant features for intrusion detection. Also, from the analysis results, it is revealed that RF is the ideal classifier to be used in conjunction with any of these four feature evaluation measures to achieve better detection accuracy than others. From the statistical results, we recommend the use of consistency measure for designing an efficient IDS in terms of DR and FAR.

A Novel IDS Evaluation Model Based by Bayes Estimation

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

Multi-agent based hybrid Intrusion detection system

Statistical Decision Modeling for IDS Alert Analysis

Class Outlier Detection Algorithm and Application in IDS Model

An empirical evaluation for the intrusion detection features based on machine learning and feature selection methods

Performance evaluation of Machine learning algorithms for Intrusion Detection System

Probabilistic Inference Strategy in Distributed Intrusion Detection Systems

An Incremental Majority Voting Approach for Intrusion Detection System Based on Machine Learning

Combining Naive Bayes and Decision Tree for Adaptive Intrusion Detection

Comparative Research on Network Intrusion Detection Methods Based on Machine Learning

An intelligent algorithm with feature selection and decision rules applied to anomaly intrusion detection

An intrusion detection method based on decision tree

NAIR: A Novel Automated Intrusion Response System Based on Decision Making Approach

Comprehensive analysis and recommendation of feature evaluation measures for intrusion detection

Comparison of Machine Learning and Deep Learning Models for Network Intrusion Detection Systems

A Model for Intrusion Detection System Based on Mobile Agent

A Novel Sequential Three-Way Decision Model for Medical Diagnosis

A multi-objective sequential three-way decision approach for real-time malware detection

Efficient Intrusion Detection Using Evidence Theory

Improving Intrusion Detection Model Prediction by Threshold Adaptation