Feature selection approach using ensemble learning for network anomaly detection

Abstract

Feature selection is essential for prioritising important attributes in data to improve prediction quality in machine learning algorithms. As different selection techniques identify different feature sets, relying on a single method may result in risky decisions. The authors propose an ensemble approach using union and quorum combination techniques with five primary individual selection methods which are analysis of variance, variance threshold, sequential backward search, recursive feature elimination, and least absolute selection and shrinkage operator. The proposed method reduces features in three rounds: (i) discard redundant features using pairwise correlation, (ii) individual methods select their own feature sets independently, and (iii) equalise individual feature sets. The equalised individual feature sets are combined using union and quorum techniques. Both the combined and individual sets are tested for network anomaly detection using random forest, decision tree, K‐nearest neighbours, Gaussian Naive Bayes, and logistic regression classifiers. The experimental results on the UNSW‐NB15 data set show that random forest with union and quorum feature sets yields 99 and 99.02% f1_score with minimum 6 and 12 features, respectively. The results on the NSL‐KDD data set show that random forest with union and quorum gets 99.34 and 99.21% f1_score with a minimum of 28 and 18 features.

Supervised feature selection techniques in network intrusion detection: A critical review

“…), it does not take into account features that characterize novel cyber attacks. Other works in the field of machine learning applied to intrusion detection rely on more recent datasets such as UNSW-NB15 [84,85,86,87]. Although quite recent, such a dataset has two limitations: first, the traffic has been collected in a reduced testbed; and secondly, the number of features is limited to 49, which is too small to appreciate the effectiveness of feature selection techniques.…”

“…), it does not take into account features that characterize novel cyber attacks. Other works in the field of machine learning applied to intrusion detection rely on more recent datasets such as UNSW-NB15 [84,85,86,87] Going more specifically into the set of works that share with this paper the aim to compare or survey FS methods for intrusion detection, we have collected the significant papers in Table 1. In it, we have identified the material covered in the literature, which helps appreciating the contributions of our paper.…”

MACPABE: Multi‐Authority‐based CP‐ABE with efficient attribute revocation for IoT‐enabled healthcare infrastructure

“…A minor data breach in the IoT device can make the entire network vulnerable to the attacker. So data encryption, as well as access control over data before transmission, is suggested by many researchers to prevent data from unwanted cyberattacks 9–13 . There exist various security protocols in literature, including digital signature, public‐key cryptosystems, authentication algorithms, and many more, which can ensure data security, integrity, authentication, and confidentiality.…”

Satellite and Scene Image Classification Based on Transfer Learning and Fine Tuning of ResNet50

“…On the basis of prediction of test dataset, images can be arranged in a semantic and meaningful order. Selection of discriminating and unique features is always beneficial as it can enhance the performance of any classification-based system [4][5][6]. In remote sensing, the problem of image classification is more challenging as objects are rotated within a view and background is usually more complex [7].…”