Feature Selection of The Anomaly Network Intrusion Detection Based on Restoration Particle Swarm Optimization

Abstract

Intrusion detection systems are vital for detecting networking attacks due to their ability to analyze network data and find different types of attacks. The high-dimensional internet data leads to feature selection becoming a fundamental process in network intrusion detection systems. The current approaches are insufficient to determine the most effective features in the network data due to the nature of intrusion attacks appearance compared to the normal data. Moreover, the wrapper feature selection methods suffer from the search time complexity such as the standard PSO algorithm for feature selection. The standard Particle Swarms Optimization (PSO) algorithm suffers from the stagnation effect in local optima. This paper proposes a new wrapper feature selection model called Restoration Particle Swarms Optimization (RPSO) to select highly relevant feature data taking into consideration the limitation of the premature convergence between the particles which results in a stagnation problem during the iteration for the optimal features. Moreover, we utilize the randomness value to overcome the stagnation problem, reduce data volume and decrease the processing time. The Random Forest algorithm uses to classify the feature selected with our solution. As a result, we consider the NSL-KDD benchmark dataset to evaluate the proposed solution. The experiments show that the performance evaluation achieves high results in general accuracy (85%) compared to standard PSO up to 83.86%. Additionally, the results show that the proposed solution increased the detecting rate of low distributing classes in the training data up to (521 classes) compared with standard PSO by (79 classes).

Optimizing Feature Selection Method in Intrusion Detection System Using Thresholding

“…High mutual information indicates that the feature is good to differentiate between classes, making more valuable information in feature. Mutual information score is defined in Eq (1).…”

“…The growth of the information and communication technology is considered massive. However, various threats to user security, information and communication infrastructure also grow [1], which include data theft, fraud, ransomware, and things that threaten communication and information infrastructure, such as Denial of Service (DoS). Thus, dealing with information and communication security threats requires appropriate handling mechanisms.…”

Feature Selection for Intrusion Detection Using Independence Level Test with an Exhaustive Approach

“…Removing relevant features when combined with others will lead to detection errors and bias. To overcome this issue, the wrapper-based method was proposed [20]. The wrapper effectively increases IDS accuracy, but training takes a long time.…”

Intrusion Detection Using Pareto Optimality Based Grasshopper Optimization Algorithm with Stacked Autoencoder in Cloud and IoT Networks

“…Chikkalwar and Garapati [17] integrated autoencoder, support vector machine (SVM), and GOA for effective detection of network intrusions. The presented model effectively resolves overfitting and data imbalance issues in the intrusion detection, but it has an issue of high computational time, Aziz and Alfoudi [18] developed a new network intrusion detection model named restoration particle swarm optimization (RPSO) for selecting relevant features from the NSL-KDD database. Sandhya and Kumarappan [19] used spider monkey optimization algorithm, and Krishna and Arunkumar [20] implemented a hybrid model: PSO and gray wolf optimization (GWO) for IoT based network intrusion…”