A Feature Selection Approach for Network Intrusion Classification: The Bi-Layer Behavioral-Based

Introduction

Intrusion detection system (IDS) is a major research problem in network security. The IDS goal is to dynamically identify unusual access or attacks to secure the networks (Tsai, 2009; Debar, 1999). Hence, Network-based IDS (NIDS) is a valuable tool for the defense in depth of computer networks. NIDS looks for known or potential malicious activities in the network traffic and raises an alarm whenever a suspicious activity is detected.

One of the important research challenges for constructing high performance IDS is dealing with data containing large number of features. Irrelevant and redundant features of the dataset complex the IDS and reduce the detection accuracy as well. Therefore, dataset dimensional reduction is an active research area in the field of machine learning and pattern recognition (Amiri, 2011; Li, 2012; Kuchimanchi, 2004). The dimensionality reduction of the dataset can be achieved by feature extraction or feature selection. Feature selection aims to choose an optimal subset of features that are necessary to increase the predictive accuracy and reduce the complexity of the learned results (Dash, 2002; Koller, 1996). Different feature selection methods are proposed to enhance the performance of IDS (Tsang, 2007). Information gain is One of the most common feature selection method (Ben-Bassat, 1982).

In this paper, we propose a bi-layer behavioral-based feature selection approach which hybrid filter and wrapper method. The proposed approach aims to improve the network intrusion classification accuracy, it consists of two layers. The first layer used information gain method to rank the features and select a new set of features depending on a global maxima classification accuracy. Followed by a second layer which selects a new set of features from within the first layer redacted data by searching for a group of local maximum classification accuracy in order to increase the number of reduced features. To evaluate the performance of the proposed bi-layer behavioral-based feature selection approach several experiments are conducted on NSL-KDD datasets using. The results obtained show the effectiveness of the proposed approach over single level feature selection method. The rest of this paper is organized as follows: the third section gives an overview of data reduction and information gain. The fourth section describes the proposed Bi-layer behavioral-based feature selection approach. The experimental results and conclusions are presented in the fifth and sixth sections respectively.