Selecting Optimal Subset of Features for Intrusion Detection Systems

摘要

The network traffic data provided for the design of intrusion detection are always large with ineffective information and high-dimensional feature vectors. This often imposes a high computational cost as well as the risk of "over fitting" when classification is performed. Therefore, it is necessary to reduce the dimensionality through ways like feature selection. Currently, there are two kinds of feature selection methods: filter method and wrapper method. The former requires no feedback from classifiers and estimates the classification performance indirectly. The latter evaluates the "goodness" of selected feature subset and it is directly based on the classification accuracy. Many experimental results have proved that the wrapper methods can yield better performance, but they have the disadvantage of high computational cost. In this paper, we effectively utilize the computer resources, both memory and CPU time, required to detect an attack by using a wrapper model for selecting features based on seven classifiers. The experimental results show that intrusion detection system with feature selection algorithm has better performance than that without feature selection algorithm both in detection accuracy and computational cost.