A Feature Selection Approach for Network Intrusion Classification: The Bi-Layer Behavioral-Based

A Feature Selection Approach for Network Intrusion Classification: The Bi-Layer Behavioral-Based

Heba F. Eid (Faculty of Science, Al-Azhar University, Cairo, Egypt), Mostafa A. Salama (Department of Computer Science, British University in Egypt, Cairo, Egypt) and Aboul Ella Hassanien (Faculty of Computers and Information, Cairo University, Gizza, Egypt &Scientific Research Group in Egypt (SRGE), Egypt )
Copyright: © 2013 |Pages: 9
DOI: 10.4018/ijcvip.2013100104
OnDemand PDF Download:
No Current Special Offers


Feature selection is a preprocessing step to machine learning, leads to increase the classification accuracy and reduce its complexity. Feature selection methods are classified into two main categories: filter and wrapper. Filter methods evaluate features without involving any learning algorithm, while wrapper methods depend on a learning algorithm for feature evaluation. Variety hybrid Filter and wrapper methods have been proposed in the literature. However, hybrid filter and wrapper approaches suffer from the problem of determining the cut-off point of the ranked features. This leads to decrease the classification accuracy by eliminating important features. In this paper the authors proposed a Hybrid Bi-Layer behavioral-based feature selection approach, which combines filter and wrapper feature selection methods. The proposed approach solves the cut-off point problem for the ranked features. It consists of two layers, at the first layer Information gain is used to rank the features and select a new set of features depending on a global maxima classification accuracy. Then, at the second layer a new subset of features is selected from within the first layer redacted data set by searching for a group of local maximum classification accuracy. To evaluate the proposed approach it is applied on NSL-KDD dataset, where the number of features is reduced from 41 to 34 features at the first layer. Then reduced from 34 to 20 features at the second layer, which leads to improve the classification accuracy to 99.2%.
Article Preview


Intrusion detection system (IDS) is a major research problem in network security. The IDS goal is to dynamically identify unusual access or attacks to secure the networks (Tsai, 2009; Debar, 1999). Hence, Network-based IDS (NIDS) is a valuable tool for the defense in depth of computer networks. NIDS looks for known or potential malicious activities in the network traffic and raises an alarm whenever a suspicious activity is detected.

One of the important research challenges for constructing high performance IDS is dealing with data containing large number of features. Irrelevant and redundant features of the dataset complex the IDS and reduce the detection accuracy as well. Therefore, dataset dimensional reduction is an active research area in the field of machine learning and pattern recognition (Amiri, 2011; Li, 2012; Kuchimanchi, 2004). The dimensionality reduction of the dataset can be achieved by feature extraction or feature selection. Feature selection aims to choose an optimal subset of features that are necessary to increase the predictive accuracy and reduce the complexity of the learned results (Dash, 2002; Koller, 1996). Different feature selection methods are proposed to enhance the performance of IDS (Tsang, 2007). Information gain is One of the most common feature selection method (Ben-Bassat, 1982).

In this paper, we propose a bi-layer behavioral-based feature selection approach which hybrid filter and wrapper method. The proposed approach aims to improve the network intrusion classification accuracy, it consists of two layers. The first layer used information gain method to rank the features and select a new set of features depending on a global maxima classification accuracy. Followed by a second layer which selects a new set of features from within the first layer redacted data by searching for a group of local maximum classification accuracy in order to increase the number of reduced features. To evaluate the performance of the proposed bi-layer behavioral-based feature selection approach several experiments are conducted on NSL-KDD datasets using. The results obtained show the effectiveness of the proposed approach over single level feature selection method. The rest of this paper is organized as follows: the third section gives an overview of data reduction and information gain. The fourth section describes the proposed Bi-layer behavioral-based feature selection approach. The experimental results and conclusions are presented in the fifth and sixth sections respectively.

Complete Article List

Search this Journal:
Volume 12: 4 Issues (2022): 1 Released, 3 Forthcoming
Volume 11: 4 Issues (2021)
Volume 10: 4 Issues (2020)
Volume 9: 4 Issues (2019)
Volume 8: 4 Issues (2018)
Volume 7: 4 Issues (2017)
Volume 6: 2 Issues (2016)
Volume 5: 2 Issues (2015)
Volume 4: 2 Issues (2014)
Volume 3: 4 Issues (2013)
Volume 2: 4 Issues (2012)
Volume 1: 4 Issues (2011)
View Complete Journal Contents Listing