Comprehensive analysis and recommendation of feature evaluation measures for intrusion detection
The revolutionary advances in network technologies have spearheaded the design of advanced cyberattacks to surpass traditional security defense with dreadful consequences. Recently, Intrusion Detection System (IDS) is considered as a pivotal element in network security infrastructures to achieve sol...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Elsevier
2020-07-01
|
| Series: | Heliyon |
| Subjects: | |
| Online Access: | http://www.sciencedirect.com/science/article/pii/S2405844020311063 |
| _version_ | 1818115914273390592 |
|---|---|
| author | Adel Binbusayyis Thavavel Vaiyapuri |
| author_facet | Adel Binbusayyis Thavavel Vaiyapuri |
| author_sort | Adel Binbusayyis |
| collection | DOAJ |
| description | The revolutionary advances in network technologies have spearheaded the design of advanced cyberattacks to surpass traditional security defense with dreadful consequences. Recently, Intrusion Detection System (IDS) is considered as a pivotal element in network security infrastructures to achieve solid line of protection against cyberattacks. The prime challenges presented to IDS are curse of high dimensionality and class imbalance that tends to increase the detection time and degrade the efficiency of IDS. As a result, feature selection plays an important role in enabling to identify the most significant features for intrusion detection. Although, several feature evaluation measures are being proposed for feature selection in literature, there is no consensus on which measures are best for intrusion detection. Therein, this work aims at recommending the most appropriate feature evaluation measure for building an efficient IDS. In this direction, four filter-based feature evaluation measures that stem from different theories such as Consistency, Correlation, Information and Distance are investigated for their potential implications in enhancing the detection ability of IDS model for different classes of attacks. Along with this, the influence of the selected features on classification accuracy of an IDS model is analyzed using four different categories of classifiers namely, K-nearest neighbors (KNN), Random Forest (RF), Support Vector Machine (SVM) and Deep Belief Network (DBN). Finally, a two-step statistical significance test is conducted on the experimental results to determine which feature evaluation measure contributes statistically significant difference in IDS performance. All the experimental comparisons are performed on two benchmark intrusion detection datasets, NSL-KDD and UNSW-NB15. In these experiments, consistency measure has best influenced the IDS model in improving the detection ability with regard to detection rate (DR), false alarm rate (FAR), kappa statistics (KS) and identifying the most significant features for intrusion detection. Also, from the analysis results, it is revealed that RF is the ideal classifier to be used in conjunction with any of these four feature evaluation measures to achieve better detection accuracy than others. From the statistical results, we recommend the use of consistency measure for designing an efficient IDS in terms of DR and FAR. |
| first_indexed | 2024-12-11T04:14:11Z |
| format | Article |
| id | doaj.art-03c36d05360d4cca8e8b03738b27b123 |
| institution | Directory Open Access Journal |
| issn | 2405-8440 |
| language | English |
| last_indexed | 2024-12-11T04:14:11Z |
| publishDate | 2020-07-01 |
| publisher | Elsevier |
| record_format | Article |
| series | Heliyon |
| spelling | doaj.art-03c36d05360d4cca8e8b03738b27b1232022-12-22T01:21:17ZengElsevierHeliyon2405-84402020-07-0167e04262Comprehensive analysis and recommendation of feature evaluation measures for intrusion detectionAdel Binbusayyis0Thavavel Vaiyapuri1Corresponding author.; College of Computer Science and Engineering, Prince Sattam bin Abdulaziz University, AlKharj, Saudi ArabiaCollege of Computer Science and Engineering, Prince Sattam bin Abdulaziz University, AlKharj, Saudi ArabiaThe revolutionary advances in network technologies have spearheaded the design of advanced cyberattacks to surpass traditional security defense with dreadful consequences. Recently, Intrusion Detection System (IDS) is considered as a pivotal element in network security infrastructures to achieve solid line of protection against cyberattacks. The prime challenges presented to IDS are curse of high dimensionality and class imbalance that tends to increase the detection time and degrade the efficiency of IDS. As a result, feature selection plays an important role in enabling to identify the most significant features for intrusion detection. Although, several feature evaluation measures are being proposed for feature selection in literature, there is no consensus on which measures are best for intrusion detection. Therein, this work aims at recommending the most appropriate feature evaluation measure for building an efficient IDS. In this direction, four filter-based feature evaluation measures that stem from different theories such as Consistency, Correlation, Information and Distance are investigated for their potential implications in enhancing the detection ability of IDS model for different classes of attacks. Along with this, the influence of the selected features on classification accuracy of an IDS model is analyzed using four different categories of classifiers namely, K-nearest neighbors (KNN), Random Forest (RF), Support Vector Machine (SVM) and Deep Belief Network (DBN). Finally, a two-step statistical significance test is conducted on the experimental results to determine which feature evaluation measure contributes statistically significant difference in IDS performance. All the experimental comparisons are performed on two benchmark intrusion detection datasets, NSL-KDD and UNSW-NB15. In these experiments, consistency measure has best influenced the IDS model in improving the detection ability with regard to detection rate (DR), false alarm rate (FAR), kappa statistics (KS) and identifying the most significant features for intrusion detection. Also, from the analysis results, it is revealed that RF is the ideal classifier to be used in conjunction with any of these four feature evaluation measures to achieve better detection accuracy than others. From the statistical results, we recommend the use of consistency measure for designing an efficient IDS in terms of DR and FAR.http://www.sciencedirect.com/science/article/pii/S2405844020311063Computer scienceCybersecurityIntrusion detectionDeep belief networkFeature selectionDistance |
| spellingShingle | Adel Binbusayyis Thavavel Vaiyapuri Comprehensive analysis and recommendation of feature evaluation measures for intrusion detection Heliyon Computer science Cybersecurity Intrusion detection Deep belief network Feature selection Distance |
| title | Comprehensive analysis and recommendation of feature evaluation measures for intrusion detection |
| title_full | Comprehensive analysis and recommendation of feature evaluation measures for intrusion detection |
| title_fullStr | Comprehensive analysis and recommendation of feature evaluation measures for intrusion detection |
| title_full_unstemmed | Comprehensive analysis and recommendation of feature evaluation measures for intrusion detection |
| title_short | Comprehensive analysis and recommendation of feature evaluation measures for intrusion detection |
| title_sort | comprehensive analysis and recommendation of feature evaluation measures for intrusion detection |
| topic | Computer science Cybersecurity Intrusion detection Deep belief network Feature selection Distance |
| url | http://www.sciencedirect.com/science/article/pii/S2405844020311063 |
| work_keys_str_mv | AT adelbinbusayyis comprehensiveanalysisandrecommendationoffeatureevaluationmeasuresforintrusiondetection AT thavavelvaiyapuri comprehensiveanalysisandrecommendationoffeatureevaluationmeasuresforintrusiondetection |