Attack classification using feature selection techniques: a comparative study

The Internet of Things (IoT) is an interconnected framework of computer devices, software, and sensors to work collectively to automate and monitor different tasks and procedures without human intervention. IoTs provide benefits and ease in performing operations for various industries and home and health stakeholders. Still, it faces security threats and challenges that make the IoT framework unreliable regarding security and privacy. Intrusion detection systems have been designed and deployed to overcome these security challenges. Over the past few years, for making the IDS intelligent artificial intelligence has been integrated with them. Besides this, different feature selection techniques are also being used to make the datasets appropriate for Machine Learning (ML) classifiers. This research uses a filter-based feature selection technique to select the important features from two datasets, UNSW-NB15 and NSL-KDD. After that, datasets with selected features are given to the classifiers as input. This work also evaluates different ML classifiers such as Multiple Layers Perceptron (MLP), CatBoost, Light Gradient Boosting (LGBM), Extra-Tree Classifier (ETC), Random Forest (RF), and K-nearest neighbor (KNN). Different metrics, Accuracy, Precision, Recall, F1, Detection Rate, and FAR, have been used for performance analysis. Evaluation results proved the LGBM classifier effective among other classifiers with 98.70% accuracy on the UNSW-NB15 dataset and 99.8% on the NSL-KDD dataset after feature selection with mean absolute difference (MAD) feature selection technique. Results are also compared with existing models to provide the efficiency of the proposed model.

Early diagnosis and treatment is very essential in monitoring Brain tumor using MRI images. Convolutional Neural Networks (CNN) and Machine Learning (ML) classifiers have been widely used but there is not much work on how feature selection techniques would affect the performance of the CNN. Secondly, there is a need for investigation concerning small dataset adaptability and ML-CNN comparisons. To improve the classification accuracy, we integrate Univariate, Recursive Feature Elimination (RFE), Recursive Feature Elimination with Cross Validation (RFECV) with CNN in this study. Preprocessing, feature extraction & selection was carried out on the dataset consisting of 253 MRI images and they are classified using CNN and ML models (Logistic Regression, Decision Tree, Random Forest, Naïve Bayes). With the results 96%, CNN with Univariate Feature Selection performed better than ML classifiers, and other selection techniques. The results demonstrate that feature selection is necessary to get the best performance out of CNN models operating on small datasets. Future studies should be based on different deep learning architectures to improve classification and application in other datasets.

Background: Utilizing cloud technology in the healthcare sector has completely changed how patient data is stored, retrieved, and shared while improving scalability and costefficiency. In this environment, however, it is crucial to ensure network security. Objective: Intrusion Detection Systems (IDS) continuously monitor network traffic and system activities to detect and neutralize possible threats. This helps preserve patient privacy and the reliability of healthcare delivery systems. We proposed Machine learning classifiers. Methods: The machine learning classifiers used four feature selection techniques: Logistic Regression, naive Baye, Decision Tree, and K-nearest neighbors with the Adam optimization method. Finally, we used the Django framework to deploy the trained model. Results: In experimental work, the NSL-KDD dataset and CICIDS-2017 dataset are used. The models were trained and tested using the same datasets to ensure consistency in data preparation. Conclusion: When the classification accuracy of the four distinct classifiers is compared, the suggested optimized Decision Tree classifier performs better.

The rapid growth of network traffic and the number of attack vectors, and the ever more advanced nature of cyberattacks have imposed serious difficulties on traditional Intrusion Detection Systems (IDS). High traffic and newer network requirements for real-time processing can often burden these systems. Smart Network Interface Cards (SmartNICs), which free CPUs from data-plane tasks, are the best candidate to help strengthen network security by accelerating packet processing with higher throughput and lower latency. However, offloading ML algorithms on SmartNICs suffers from limitations such as computational efficiency and resource constraints. This work presented a comparative study on three typical ML classifiers decision tree (DT), random forest (RF) and K-Nearest Neighbor (KNN) for SmartNIC-based real-time intrusion detection and compared them systematically. On the NSL-KDD dataset, a standard benchmark dataset for network traffic analysis demonstrates the performance, efficiency, and hardware viability of all models. The experimental results demonstrate that RF provides the best trade-off between accuracy and inference time, compared with DT and KNN. Secondly, this study also highlights the significance of the data preprocessing, including feature selection and encoding, that contributes to tuning the model performance under resource-constrained SmartNIC platforms. This study aims to help researchers and practitioners in designing scalable, low-latency IDSs that are more insightful toward the deployment of Machine Learning (ML) powered security on SmartNICs and moving cyber security towards more robust and efficient infrastructures.

The rapid growth of the Internet of Things (IoT) has introduced considerable security challenges, making Intrusion Detection Systems (IDS) essential for protecting connected devices from cyber threats. This paper presents an Artificial Intelligence (AI)-driven Intrusion Detection System (IDS) designed for IoT environments, utilizing machine learning and anomaly detection techniques. The system leverages the NSL-KDD dataset to distinguish between normal and anomalous network traffic. We implemented multiple feature selection techniques, including correlation-based selection, Recursive Feature Elimination (RFE), and LASSO, to optimize model performance. Various machine learning classifiers, including Random Forest (RF), Bagging, Support Vector Machines (SVM), and K-Nearest Neighbors (KNN), were evaluated using key performance metrics such as accuracy, recall, precision, and AUC-ROC. Experimental results indicate that Random Forest and Bagging outperformed other models, achieving the highest accuracy of 99.89%, with an AUC-ROC of 99.88%, outperforming other models in intrusion detection. Additionally, feature selection methods effectively reduced dataset dimensionality while maintaining high detection performance. Despite these promising results, challenges such as high training time, false positives, and real-time adaptability remain critical concerns for practical deployment in IoT systems.

Nowadays, Internet-driven culture securing computer networks in Higher Learning Institutions (HLIs) has become a major responsibility. Intrusion Detection Systems (IDS) are crucial for protecting networks from unauthorized activity and cyber threats. This paper examines the process of improving network security by creating a comprehensive IDS dataset using real traffic from HLIs, highlighting the importance of accurate and representative data in improving the system's ability to identify and mitigate future cyber-attacks. The IDS model was created using a variety of machine learning (ML) techniques. Metrics like accuracy, precision, recall, and F1-score were used to assess the performance of each model. The dataset used for training and testing was real-world network traffic data obtained from the institution's computer network. The results showed that the developed IDS obtained exceptional accuracy rates, with Random Forest, Gradient Boosting, and XGBoost models all achieving an accuracy of around 93%. Precision and recall values were likewise quite high across all algorithms. Furthermore, the study discovered that data quality has a substantial impact on IDS performance. Proper data preparation, feature engineering, and noise removal were found to be helpful in improving model accuracy and reducing false positives. While the IDS models performed well throughout validation and testing, implementing such systems in a production setting necessitates careful thought. As a result, the essay also examined the procedures for testing and deploying the IDS models in a real-world scenario. It underlined the significance of ongoing monitoring and maintenance in order to keep the model effective in identifying intrusions. The research aids in the progress of network security in HLI. Educational institutions can better protect their precious assets and sensitive information from cyberattacks by understanding the impact of data quality on IDS performance and implementing effective deployment techniques

In light of rapid technological developments, a marked rise in global internet usage has contributed to increased sensitive data flow across networks. This increase leads to the diversification of malicious attacks and makes cyber security requirements more evident. In order to ensure network security, intrusion detection systems stand out as an essential component. Intrusion detection systems detect suspicious and malicious activities over network traffic, allowing network administrators and experts to monitor current threats continuously. In anomaly-based systems, machine learning approaches are applied to identify abnormal attempts in network traffic. This study presents a feature selection framework for anomaly-based attack detection systems by combining machine learning and heuristic algorithms. This proposed study aims to improve the performance of IDSs in terms of both time and attack detection by selecting features with heuristic approaches. In the proposed approach, PSO, FPA, DE feature selection methods and LR, DT, RF, KNN, NB, GB, LDA, QDA, AdaBoost, and NN machine learning algorithms are used to perform anomaly-based comparative analyses on KDDCup99, NSL-KDD, UNSW-NB15, CSE-CIS-IDS2018 datasets. Analyses conducted on these datasets with various features demonstrated that models employing feature selection achieved an approximate two-hundred-percent improvement in time efficiency compared to models that did not utilize feature selection. It has been determined that DE, PSO, and FPA, which are used for feature selection, provide high-accuracy outputs when combined with different classifiers. When the analysis results are assessed according to the specified criteria, the highest F1-Score values achieved are as follows: 0.9972 for the DE method in GB, 0.9969 for the PSO method in GB, and 0.9948 for the FPA method in GB, on the KDD CUP 99 dataset. In the NSL-KDD, used as the second dataset, the DE method achieved a score of 0.9713 in GB, the PSO method reached 0.9112 in DT, and the FPA method obtained 0.9894 in RF, respectively. In the third dataset, UNSW-NB15, the DE method achieved a score of 0.9507 in DT, the PSO method reached 0.9068 in DT, and the FPA method obtained 0.8924 in NN. Finally, in the CSE-CIC-IDS2018 dataset, the highest scores achieved using the RF algorithm were 0.99986 for the DE method, 0.99989 for the PSO method, and 0.99987 for the FPA method, based on feature selection. The obtained results underscore the critical role of dataset generation processes and network traffic dynamics in enhancing the performance of intrusion detection systems. Additionally, the significance of feature selection was highlighted. These findings offer valuable insights and present opportunities for further advancements in future research.

An essential tool for monitoring and identifying intrusion threats is the intrusion detection system (IDS). As a result, intrusion detection systems monitor network traffic heading through computer systems to detect for malicious activity and recognized dangers, and send alerts. With a focus on datasets, ML methods, and metrics, this study tries to analyse recent IDS research using a Machine Learning (ML) approach. To make sure the model is suitable for IDS application, dataset selection is crucial. The efficiency of the ML method can also be impacted by the dataset structure. As a result, the choice of ML algorithm depends on the dataset's structure. Metric will then offer a quantitative assessment of ML algorithms for a given dataset. In addition True Positive Rate (TPR), False Positive Rate (FPR) and accuracy, are the three metrics for IDS performance evaluation that are most frequently utilized. This is understandable given that these metrics offer crucial cues that are crucial to IDS performance. A clear path and direction for future study has been provided by the discussion and comparison of the results from various works.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

Diabetes mellitus is a group of metabolic diseases in which blood sugar levels are too high. About 8.8% of the world was diabetic in 2017. It is projected that this will reach nearly 10% by 2045. The major challenge is that when machine learning-based classifiers are applied to such data sets for risk stratification, leads to lower performance. Thus, our objective is to develop an optimized and robust machine learning (ML) system under the assumption that missing values or outliers if replaced by a median configuration will yield higher risk stratification accuracy. This ML-based risk stratification is designed, optimized and evaluated, where: (i) the features are extracted and optimized from the six feature selection techniques (random forest, logistic regression, mutual information, principal component analysis, analysis of variance, and Fisher discriminant ratio) and combined with ten different types of classifiers (linear discriminant analysis, quadratic discriminant analysis, naïve Bayes, Gaussian process classification, support vector machine, artificial neural network, Adaboost, logistic regression, decision tree, and random forest) under the hypothesis that both missing values and outliers when replaced by computed medians will improve the risk stratification accuracy. Pima Indian diabetic dataset (768 patients: 268 diabetic and 500 controls) was used. Our results demonstrate that on replacing the missing values and outliers by group median and median values, respectively and further using the combination of random forest feature selection and random forest classification technique yields an accuracy, sensitivity, specificity, positive predictive value, negative predictive value and area under the curve as: 92.26%, 95.96%, 79.72%, 91.14%, 91.20%, and 0.93, respectively. This is an improvement of 10% over previously developed techniques published in literature. The system was validated for its stability and reliability. RF-based model showed the best performance when outliers are replaced by median values.

Breast cancer is a leading global cause of cancer-related deaths highlighting the need for an accurate diagnostic system. Up to now, computer-aided diagnosis (CAD) system plays an essential role in supporting pathologists with prompt and accurate classification. Feature selection within the CAD system is crucial as it helps identify the most relevant data for subsequent classification tasks. This paper proposed a novel method that focuses on fuzzy discretization in handling continuous features and selecting relevant and interactive features while eliminating redundancy using Class Association Rule Mining (CARM). The proposed method, FD-CARI was compared with other feature selection techniques including CFS, FCBF, Consistency, Relief-F, and mRMR using five different machine learning classifiers such as Decision Tree (DT), Random Forest (RF), Logistic Regression (LR), Naive Bayes (NB), and Support Vector Machine (SVM). Performance evaluation metrics such as Accuracy (ACC), Sensitivity (SEN), Specificity (SPE), Precision, F1-Score, and AUC were then utilized. Results: The experimental findings consistently showed that the proposed method achieved high performance with an ACC of 96.21%, SEN of 94.26%, and SPE of 97.38% on the SVM classifiers, and an ACC of 96.05%, SEN of 93.82%, and SPE of 97.38% on the LR classifiers. It demonstrated similar effectiveness to Relief-F for DT and RF classifiers. However, FCBF achieved the highest performance on NB with ACC, SEN, and SPE values of 96.21%, 92%, and 96.60%, respectively. The proposed method efficiently selects relevant and interactive features while enabling classifiers to achieve better classification accuracy.

Uses of Artificial Intelligent Techniques to Build Accurate Models for Intrusion Detection System

Machine learning (ML) techniques are essential in the detection of network attacks and enhancing network security. A device or software that recognizes any unusual pattern in the network and alerts the user about the same is an intrusion detection system (IDS). In this chapter, we have described the use of ML classification algorithms on the UNSW-NB15 dataset, leading to the generation of a network intrusion detection model which classifies incoming traffic into malicious or non-malicious traffic and issues an alert to the user. We have implemented the following ML algorithms – support vector machine, artificial neural network, and one-class support vector machine with an average accuracy of 89.25%, 91.54%, and 93.05%, respectively. Two graphical user interfaces (online and offline versions) have been developed for the system. Thus, the chapter proposes an optimized intrusion detection system that improves upon the existing intrusion detection systems which detect malicious packets in the network.

Multi-level hybrid support vector machine and extreme learning machine based on modified K-means for intrusion detection system

The world has experienced a radical change due to the internet. Internet became a crucial element in our daily life, therefore, the security of our DATA could be threatened at any time. This safety is handled using systems to detect network intrusion called Intrusion Detection Systems (IDS). Machine learning techniques are being implemented to improve these systems. In order to enhance the performance of IDS, different classification algorithms are applied to detect various types of attacks. Choosing a good one for building IDS is not an easy task. The best method is to test the performance of the different classification algorithms. Nevertheless, most researchers have focused on the confusion matrix as measurements of classification performance. Therefore, many papers use this matrix to present a detailed comparison with the dataset, data preprocessing, feature selection technique, algorithms classification and performance evaluation. The goal of this paper is to present a comparison of application of different Machine Learning algorithms used to build and improve intrusion detection systems in terms of confusion matrix, accuracy, recall, precision, FAR, specificity and sensitivity using the UNSW-NB15 Dataset. Furthermore, we introduce some lesson learnt to shoot more researchers in their future works.