EFS-DNN: An Ensemble Feature Selection-Based Deep Learning Approach to Network Intrusion Detection System

Abstract

In recent years, the scale of networks has substantially evolved due to the rapid development of infrastructures in real networks. Under the circumstances, intrusion detection systems (IDSs) have become the crucial tool to detect cyberattacks, malicious actions, and anomaly behaviors that threaten the credibility and integrity of information services in networks. The feature selection technologies are commonly applied in various intrusion detection algorithms owing to the potential of improving performance and speeding up decision-making. However, existing feature selection-based intrusion detection methods still suffer from high computational complexity or the lack of robustness. To mitigate these challenges, we propose a novel ensemble feature selection-based deep neural network (EFS-DNN) to detect attacks in networks with high-volume traffic data. In particular, we leverage light gradient boosting machine (LightGBM) as the base selector in the ensemble feature selection module to enhance the robustness of the selected optimal subset. Besides, we utilize a deep neural network with batch normalization and embedding technique as the classifier to improve the expressiveness. We conduct extensive experiments on three public datasets to demonstrate the superiority of the EFS-DNN compared with baselines.

Exploring Lightweight Deep Learning Techniques for Intrusion Detection Systems in IoT Networks: A Survey

“…Additionally, a convolutional neural network (CNN) is employed for classifying the NSL.KDD dataset into normal and attack categories. In [73] the process employs an ensemble feature selection-based DNN to efficiently identify anomalous behaviors in network traffic data. It combines a light gradient boosting machine LightGBM for feature selection and a DNN integrated with batch normalization and embedding techniques as the classifier.…”

A uniform network flow feature aggregation method based on parallel LSTM

“…Among various preprocessing methods, feature selection and feature extraction have been the focus of many studies. Wang Z et al [13] proposed a new deep neural network called Ensemble Feature Selection-based Deep Neural Network (EFS-DNN) for detecting attacks in large-scale network traffic data. Sakiyama A et al .…”

PSO-Driven Feature Selection and Hybrid Ensemble for Network Anomaly Detection

“…Individual algorithms are referred to as first-level algorithms, while the combiner is referred to as a second-level algorithm or meta-classifier. Jafarian et al [16], Kaur [17], Jain and Kaur [21], Rashid et al [29], Wang et al [30] demonstrate that stacking generates a promising intrusion detection capability; however, most of the proposed stacking procedures do not consider LR as a second-level algorithm, as suggested by [32]. Alternatively, combiner strategies, such as majority voting [22] and weighted majority voting [25,28] may be utilized as anomaly detectors.…”

“…Furthermore, it is possible to construct homogeneous ensembles in which an ensemble procedure is built upon a single (e.g., the same type) algorithm. Kaur [17] compares three different adaptive boosting (AB) [33] families of algorithms for anomaly-based IDS, while the rest of proposed approaches utilize tree-based ensemble learning, such as RF [18,20,24,26,27], LightGBM [18,23,30], and XGBoost [18,19,27].…”

“…In addition, previous research indicates that feature selectors using the wrapper technique are taken into account. A wrapper-based feature selector evaluates a specific machine learning algorithm to search optimal feature subset [17,18,21,30]. Examining the above-mentioned methods for anomaly detectors, our study fills a gap by examining hybrid ensemble and PSO-based feature selection, both of which are underexplored in the existing literature.…”