A NSGA2-LR wrapper approach for feature selection in network intrusion detection

Regarding the security of computer systems, the intrusion detection systems (IDSs) are essential components for the detection of attacks at the early stage. They monitor and analyze network traffics, looking for abnormal behaviors or attack signatures to detect intrusions in real time. A major drawback of the IDS is their inability to provide adequate sensitivity and accuracy, coupled with their failure in processing enormous data. The issue of classification time is greatly reduced with the IDS through feature selection. In this paper, a new feature selection algorithm based on Firefly Algorithm (FA) is proposed. In addition, the naive bayesian classifier is used to discriminate attack behaviour from normal behaviour in the network traffic. The FA selects the discriminating features from NSL-KDD dataset. The performance of the IDS in the detection of attacks was enhanced by the proposed model and compare with other models.

One of the key challenges of the machine learning (ML) based intrusion detection system (IDS) is the expensive computation time which is largely caused by the redundant, incomplete, and unrelated features contain in the IDS datasets. To overcome such challenges and ensure building efficient and more accurate IDS models, many researchers utilize preprocessing techniques such as normalization and feature selection, and a hybrid modeling approach is typically used. In this work, we propose a hybrid IDS modeling approach with an algorithm for feature selection (FS) and another for building the IDS. The FS method is a wrapper-based FS with a decision tree as the feature evaluator. Five selected ML algorithms are individually used in combination with the proposed FS method to build five IDS models using the UNSW-NB15 dataset. As a baseline, five more IDS models are built, in a single modeling approach, using the full features of the datasets. We evaluate the effectiveness of our proposed method by comparing it with the baseline models and also with state-of-the-art works. Our method achieves the best DR of 97.95% and proved to be quite effective in comparison to state-of-the-art works. We, therefore, recommend its usage especially in IDS modeling with the UNSW-NB15 dataset.

Feature selection is a very important direction for network intrusion detection. However, current feature selection technology of network intrusion detection has the problems of low detection rate and low accuracy due to feature redundancy. An improved Butterfly Optimization Algorithm combined with Black Widow Optimization (BWO-BOA) is proposed in this paper, which introduces a dynamic adaptive search strategy in the global search phase of the Butterfly Optimization Algorithm (BOA), uses the movement search process of Black Widow Optimization (BWO) algorithm as the local search, and at the same time, in order to overcome the improved butterfly optimization algorithm easily falling into a local optimum in local search phase, takes advantage of the small probability mutation strategy to filter out the redundant features. This paper then tries to apply the proposed BWO-BOA algorithm to feature selection of network intrusion detection. In order to verify the performance of the proposed BWO-BOA algorithm, the UNSW-NB15 dataset is selected for binary classification and multi-classification simulation experiments, and the feature selection models of BWO-BOA algorithm, BOA algorithm, BWO algorithm, Particle Swarm Optimization, Salp Swarm Algorithm, Whale Optimization Algorithm and improved Butterfly Optimization Algorithm are compared for validation. The experimental results show that the proposed BWO-BOA algorithm can enhance the performance of the feature selection model in network intrusion detection and significantly boost the reduction of feature dimensions.

Monitoring network traffic and detecting security threats is a vital task in today's world, and intrusion detection systems (IDS) have become an essential tool for this purpose. However, IDSs have to analyze large volumes of data, which often contain irrelevant and redundant features. This makes the job of IDSs more challenging, as they must sift through all available features to identify attack patterns, leading to longer processing time and reduced detection accuracy. To address this, we propose a new wrapper approach for solving the feature selection (FS) problem. Our proposed approach uses a novel multi‐objective binary bat algorithm (MBBA‐FS) with a decision tree classifier. The MBBA‐FS aims to produce a set of non‐dominated solutions that minimize the number of features used while maintaining a high detection accuracy. Then, we use a frequency ranking method to identify a single subset of relevant features from the resulting set of non‐dominated solutions. We tested the feasibility and performance of our approach against other leading FS methods using various datasets, including KDD CUP 1999, NLS‐KDD, UNSW‐NB15, and several synthetic benchmarks. The experimental results show that MBBA‐FS outperforms existing FS approaches in terms of classification accuracy and number of selected features.

This paper attempts to provide a demonstration the importance of the feature selection (FS) in the data mining filed for the optimization. The author’s aim to develop a Convolutional Neural Network (CNN) based Network Intrusion Detection System (NIDS). The CNN was trained using the NSL-KDD dataset. The approach is divided into two methodologies: the first one, is to apply the CNN to the NSL-KDD dataset without FS, in the second methodology: the Information Gain (IG), Grain Ratio (GR) and Correlation Attribute (CA) were applied as FS methods then the CNN is use to classify the intrusion. The performance is proven by comparing our results with other previous works. Our experimentation results show that CNN with FS has a good accuracy 99,72%, true positive rate: 99,29%, false positive rate: 0,18%. Thus, the CNN with FS has outperform the other methods. But the methods use in the FS phase don’t guarantee the use of the best subset or the optimal subset. As future orientation is to develop another method for FS which guarantee the selection of the best and the optimal relevant feature.

Today billions of people are accessing the internet around the world. There is a need for new technology to provide security against malicious activities that can take preventive/ defensive actions against constantly evolving attacks. A new generation of technology that keeps an eye on such activities and responds intelligently to them is the intrusion detection system employing machine learning. It is difficult for traditional techniques to analyze network generated data due to nature, amount, and speed with which the data is generated. The evolution of advanced cyber threats makes it difficult for existing IDS to perform up to the mark. In addition, managing large volumes of data is beyond the capabilities of computer hardware and software. This data is not only vast in scope, but it is also moving quickly. The system architecture suggested in this study uses SVM to train the model and feature selection based on the information gain ratio measure ranking approach to boost the overall system's efficiency and increase the attack detection rate. This work also addresses the issue of false alarms and trying to reduce them. In the proposed framework, the UNSW-NB15 dataset is used. For analysis, the UNSW-NB15 and NSL-KDD datasets are used. Along with SVM, we have also trained various models using Naive Bayes, ANN, RF, etc. We have compared the result of various models. Also, we can extend these trained models to create an ensemble approach to improve the performance of IDS.

Network intrusion detection systems (NIDS) are essential security building-blocks for today's organizations to ensure safe and trusted communication of information. In this paper, we study the feasibility of off-line deep learning based NIDSes by constructing the detection engine with multiple advanced deep learning models and conducting a quantitative and comparative evaluation of those models. We first introduce the general deep learning methodology and its potential implication on the network intrusion detection problem. We then review multiple machine learning solutions to two network intrusion detection tasks (NSL-KDD and UNSW-NB15 datasets). We develop a TensorFlow-based deep learning library, called NetLearner, and implement a handful of cutting-edge deep learning models for NIDS. Finally, we conduct a quantitative and comparative performance evaluation of those models using NetLearner.

The Internet of Things (IoT) is an interconnected framework of computer devices, software, and sensors to work collectively to automate and monitor different tasks and procedures without human intervention. IoTs provide benefits and ease in performing operations for various industries and home and health stakeholders. Still, it faces security threats and challenges that make the IoT framework unreliable regarding security and privacy. Intrusion detection systems have been designed and deployed to overcome these security challenges. Over the past few years, for making the IDS intelligent artificial intelligence has been integrated with them. Besides this, different feature selection techniques are also being used to make the datasets appropriate for Machine Learning (ML) classifiers. This research uses a filter-based feature selection technique to select the important features from two datasets, UNSW-NB15 and NSL-KDD. After that, datasets with selected features are given to the classifiers as input. This work also evaluates different ML classifiers such as Multiple Layers Perceptron (MLP), CatBoost, Light Gradient Boosting (LGBM), Extra-Tree Classifier (ETC), Random Forest (RF), and K-nearest neighbor (KNN). Different metrics, Accuracy, Precision, Recall, F1, Detection Rate, and FAR, have been used for performance analysis. Evaluation results proved the LGBM classifier effective among other classifiers with 98.70% accuracy on the UNSW-NB15 dataset and 99.8% on the NSL-KDD dataset after feature selection with mean absolute difference (MAD) feature selection technique. Results are also compared with existing models to provide the efficiency of the proposed model.

Intrusion detection systems (IDSs) monitor network traffics to find suspicious activities, such as an attack or illegal activities. These systems play an important role in securing computer networks. Due to availability of irrelevant or redundant features and big dimensionality of network datasets which results to an inefficient detection process, this study, focused on identifying important attributes in order to build an effective IDS. A majority vote system, using three standard feature selection methods, Correlation-based feature selection, Information Gain, and Chi-square is proposed to select the most relevant features for IDS. The decision tree classifier is applied on reduced feature sets to build an intrusion detection system. The results show that selected reduced attributes from the novel feature selection system give a better performance for building a computationally efficient IDS system.

Intrusion Detection Systems (IDS) play a critical role in identifying cyber threats and securing network environments. This research proposes an optimized IDS by leveraging the Dragonfly Algorithm (DA) for feature selection and employing Extra Trees (ET) and K-Nearest Neighbors (KNN) for classification. The UNSW-NB15 dataset is used for evaluation, ensuring a robust and realistic assessment. The implementation, conducted in Python, demonstrates that ET, when combined with DA-based feature selection, achieves an accuracy of 100%, highlighting its effectiveness in distinguishing between normal and malicious traffic. The results confirm that intelligent feature selection significantly enhances IDS performance, reducing computational complexity while improving detection accuracy. This study contributes to the advancement of IDS methodologies, offering a highly efficient approach for real-world cybersecurity applications.

Feature selection is one of the most significant procedures in machine learning algorithms. It is particularly to improve the performance and prediction accuracy for complex data classification. This paper discusses a hybrid feature selection technique with the decision tree-based classification algorithm. The feature selected using information gain (IG) is combined with the features selected from ReliefF which generates the resultant feature subset. Then the resultant feature subset is in turn combined with a correlation-based feature selection (CFS) method to generate the aggregated feature subset. To perform classification accuracy on the aggregated feature subset, different decision trees-based classification algorithm such as C4.5, decision stumps, naive Bayes tree, and random forest with ten-fold cross-validation have been deployed. To check the prediction accuracy of the proposed work eight different multilevel University of California, Irvine (UCI) machine learning datasets have been used with minimum to maximum numbers of features. The main objective of the hybrid feature selection is to improve the classification accuracy, prediction and to reduce the execution time using standard datasets.

The goal of securing a network is to protect the information flowing through the network and to ensure the security of intellectual as well as sensitive data for the underlying application. To accomplish this goal, security mechanism such as Intrusion Detection System (IDS) is used, that analyzes the network traffic and extract useful information for inspection. It identifies various patterns and signatures from the data and use them as features for attack detection and classification. Various Machine Learning (ML) techniques are used to design IDS for attack detection and classification. All the features captured from the network packets do not contribute in detecting or classifying attack. Therefore, the objective of our research work is to study the effect of various feature selection techniques on the performance of IDS. Feature selection techniques select relevant features and group them into subsets. This paper implements Chi-Square, Information Gain (IG), and Recursive Feature Elimination (RFE) feature selection techniques with ML classifiers namely Support Vector Machine, Naive Bayes, Decision Tree Classifier, Random Forest Classifier, k-nearest neighbours, Logistic Regression, and Artificial Neural Networks. The methods are experimented on NSL-KDD dataset and comparative analysis of results is presented.

The intrusion detection system has been widely studied and deployed by researchers for providing better security to computer networks. The increasing volume of attacks, com-bined with the rapid improvement of machine learning (ML) has made the collaboration of intrusion detection techniques with machine learning and deep learnings are a popular subject and a feasible approach for cyber threat protection. Machine learning usually involves the training process using huge sample data. Since the huge input data may cause a negative effect on the training and detection performance of the machine learning model, feature selection becomes a crucial technique to rule out the irrelevant and redundant features from the dataset. This study applied a feature selection approach for intrusion detection that incorporated state-of-the-art feature selection algorithms with attack characteristic feature to produce an optimized set of features for the machine learning algorithms, which was then used to train the machine learning model. CSECIC- IDS2018 dataset, the most recent benchmark dataset with a wide attack diversity and features have been used to create the efficient feature subset. The result of the experiment was produced using machine learning models with a decision tree classifier and analyzed with respect to the accuracy, precision, recall, and f1 score.

Feature selection has emerged as a craft, using which we boost the performance of our learning model. Feature or Attribute Selection is a data preprocessing technique, where only the most informative features are considered and given to the predictor. This reduces the computational overhead and improves the correctness of the classifier. Attribute Selection is commonly carried out by applying some filter or by using the performance of the learning model to gauge the quality of the attribute subset. Metric Ranked Feature Inclusion and Accuracy Ranked Feature Inclusion are the two novel hybrid feature selection methods we introduce in this paper. These algorithms follow a two-stage procedure, the first of which is feature ranking, followed by feature subset selection. They differ in the way they rank the features but follow the same subset selection technique. Multiple experiments have been conducted to assess our models. We compare our results with numerous works of the past and validate our models using 12 datasets. From the results, we infer that our algorithms perform better than many existent models.

The Internet of Things (IoT) represents a paradigm shift in which the Internet is connected to real objects in a range of areas, including home automation, industrial processes, human health, and environmental monitoring. The global market for IoT devices is booming, and it is estimated that there will be 50 billion connected devices by the end of 2025. This explosion of IoT devices, which can be expanded more easily than desktop PCs, has led to an increase in cyber-attacks involving IoT devices. To address this issue, it is necessary to create novel approaches for identifying attacks launched by hacked IoT devices. Due to the possibility that these attacks would succeed, Intrusion Detection Systems (IDS) are required. IDS' feature selection stage is widely regarded as the most essential stage. This stage is extremely time-consuming and labor-intensive. However, numerous machine learning (ML) algorithms have been proposed to enhance this stage to boost an IDS's performance. These approaches, however, did not produce desirable results in terms of accuracy and detection rate (DR). In this paper, we propose a novel hybrid Autoencoder and Modified Particle Swarm Optimization (HAEMPSO) for feature selection and deep neural network (DNN) for classification. The PSO with modification of inertia weight was utilized to optimize the parameters of DNN. The experimental analysis was performed on two realistic UNSW-NB15 and BoT-IoT datasets that are suitable for IoT environment. The findings obtained by analyzing the proposed HAEMPSO against the Generic attack in the UNSW-NB15 dataset gave an accuracy of 98.8%, and a DR of 99.9%. While the benign class revealed an accuracy of 99.9% and DR of 99.7%. In the BoT-IoT dataset, the DDoS HTTP attack revealed an accuracy of 99.22% and DR of 97.79%. While the benign class gave an accuracy of 97.54% and DR of 97.92%. In comparison with the state-of-the-art machine learning schemes, our proposed HAEMPSO-DNN achieved a competitive feat in terms of DR and accuracy.