A Hybrid Intrusion Detection System Based on Feature Selection and Weighted Stacking Classifier

Abstract

Cyber-attacks occur more frequently with the rapid growth in the Internet. Intrusion detection systems (IDS) have become an important part of protecting system security. There are still some challenges preventing IDS from further improving its classification performance. Firstly, the complexity of high-dimensional features challenges the speed and the performance of the classification for IDS. Secondly, the classification performance of traditional Stacking algorithm can be easily affected by the base classifiers. Tackling both challenges above, we propose a hybrid intrusion detection system based on a CFS-DE feature selection algorithm and a weighted Stacking classification algorithm. To limit the dimension of the features, we deployed the CFS-DE algorithm, which searches for the optimal feature subset. Afterwards, a weighted Stacking algorithm is proposed, which increases the weights of the base classifiers with good training results and drops those base classifiers with bad ones to improve the classification performance. As such, the model enhances the classification efficiency and yielding better accuracy. All experiments in this study were conducted on the NSL-KDD and CSE-CIC-IDS2018 data sets. The results based on KDDTest+ show that our proposed model has accuracy of 87.44%, precision of 89.09%, recall of 87.44% and F1-score of 88.25%. The results based on CSE-CIC-IDS2018 show that our proposed model has accuracy of 99.87%, precision of 99.88%, recall of 99.87% and F1-score of 99.88%. Compared with traditional machine learning models and models mentioned in other papers, out proposed CFS-DE-weighted-Stacking IDS has the best classification performance.

An Intelligent Agent-Based Detection System for DDoS Attacks Using Automatic Feature Extraction and Selection

“…There are 250 machines in the attack infrastructure and 620 laptops and desktops, and 40 servers in the victim organization’s network. Dataset analysis and other related principles have been described in detail in published research materials [ 33 , 34 ].…”

“…Additional papers [ 23 , 24 , 25 , 26 , 27 , 31 , 32 , 33 , 34 ] presented other approaches to detect DDoS attacks. These include using deep learning [ 25 ], traffic authentication [ 26 ], a cascaded federated deep learning framework [ 25 ], and artificial intelligence merged methods [ 31 ].…”

A Novel Hybrid Feature Selection with Cascaded LSTM: Enhancing Security in IoT Networks

“…Proposed WCGAN-GP [36] WAE-DNN [37] EHHO + GRU [39] Custom CNN + LSTM [43] IG-CS-PSO + RF [45] ABC-BWO-CONV-LSTM [40] RF-RFE + ensemble [44] FOA + ensemble method [42] Bagging BGM [ As the reach of IoT networks grows, the need for efficient IDS like the one presented in this study becomes increasingly critical. Future research efforts will focus on balancing attack category distributions in datasets.…”

A hybrid deep learning approach for enhanced network intrusion detection

“…An IDS monitors network and system activities, identifying and responding to unusual behavior that could signal a potential security threat [4]. The cloud infrastructure's dynamic and scalable nature poses unique challenges for intrusion detection, as attacks can manifest in various forms, including DDoS, unauthorized access attempts, and malware injection [16]. IDS in the cloud relies on advanced algorithms and machine learning techniques to analyze massive datasets and detect patterns indicative of malicious activity.…”