A Comparative Assessment of Wrappers and Filters for Detecting Cyber Intrusions

The high number of features in network traffic data might overload intrusion detection systems (IDSs) and resulted in overfitting. Furthermore, duplicated, and unnecessary features may restrict an IDS's ability to learn and infer. Generally, feature selection methods can alleviate this issue. It is a data pre-processing step that can be applied before the classification phase and aims to improve classifier performance and interpretability by selecting only a few highly informative features. The present study aims at assessing the effects of four filters (Consistency-based subset selection, Pearson correlation, Double Input Symmetric Relevance and Chi2); and four wrappers (Boruta, BorutaShap, Recursive Feature Elimination, and Genetic Algorithm) on the classification effectiveness of four models: Random Forest, Multilayer Perceptron, eXtreme Gradient Boosting and Support Vector Machines using CICIDS2018 dataset. The findings suggested that combining ensemble models with RFE and CON techniques can effectively reduce the number of attributes without impacting the outcomes of classification.