A comparative study of use of Shannon, Rényi and Tsallis entropy for attribute selecting in network intrusion detection

Abstract

The selection of optimal attributes from the set of all possible attributes of a network traffic is the first step to detect network intrusions. However, in order to optimize the effectiveness of intrusion detection procedure and decrease its complexity, it is still a challenge to select an optimal attribute subset. In this context, the primary problem of attribute selection is the criterion to evaluate a given attribute subset. In this work, it is presented an evaluation of Rényi and Tsallis entropy performances compared with Shannon entropy in order to obtain an optimal attribute subset that increase the capability of the Intrusion Detection System to classify the traffic as normal or as suspicious. In the experimental results, the detection accuracy and the false alarm rate almost remains the same or even becomes better depending on the attack category (e.g. in the DoS and Probing attack) when small attribute subsets are used compared when all attributes are used.

A Survey of Distance and Similarity Measures Used Within Network Intrusion Anomaly Detection

“…Within the field of Network Intrusion (NI) datasets the closest work to this is by Chmielewski and Wierzchoń [2] which examines the problems inherent in using the l p -metric (defined in (5), where p = r ≥ 1), fractional l p -distance (defined in (5), where 0 < p = r < 1), and cosine similarity (defined in (35)) to measure the distance between different samples of highdimensional data. Through experimentation using differing values of p on the l p -metric, and using the resulting distance in an application of negative selection to a NI dataset, they conclude that values of p on the interval [0.5, 1.0] should provide an improvement in detection rate compared to other values.…”

“…A fourth method in this category is one that is based on Learning Vector Quantization, and uses the cosine similarity with an Artificial Neural Network. The definition of cosine similarity is shown in (35), where φ is the angle between vectors x and y.…”

“…Some prior research has very effectively compared classification performance results when using multiple distance measures. Chmielewski and Wierzchoń [2] examine the use of the l pmetric ((5), with p = r ≥ 1), fractional l p -distance ((5), with 0 < p = r < 1), and cosine similarity (35) to measure the distance between different samples of high-dimensional data. Through experimentation using differing values of p on the l pmetric, and using the resulting distance in an application of negative selection to a Network Intrusion (NI) dataset, they conclude that values of p on the interval [0.5, 1.0] should provide an improvement in detection rate compared to other values when applied to high-dimensional datasets.…”

“…In all three examples KLD is used as a basic measure of similarity with a threshold set by the research used to determine the gain. Lima et al [35] present a comparison of different entropy measures (Rènyi, Tsallis, and Shannon) for feature selection. The three definitions of entropy are each used for feature reduction based upon the gain ratio, then the 10 attributes with the highest gain ratios are selected.…”

“…One article by Obimbo explores the performance of classification using two measures -Euclidean distance, and a custom measure based on a voting system [37]. Another exemplar comparison study reviewed performance of three measures of entropy for determining the best features to use [35]. These authors are paving the way by using distance measure as another factor in experiment design.…”