Machine learning (ML) classifiers have been widely applied in network intrusion detection recently, but at the same time, the application of ML classifiers also faces an emerging serious problem, which is the performance of these ML classifiers degrades over time due to the evolving nature of network attacks. Existing ML intrusion detection models typically mitigate this aging with costly retraining and active learning, yet they overlook how redundant and irrelevant features exacerbate the aging process. This paper introduces a novel feature selection algorithm, Robust Feature Integration (RFI), which innovatively combines dynamic and static feature selection. RFI first uses static feature selection based on feature correlation to reduce the number of features, then applies conditional mutual information in a greedy policy for dynamic feature selection to further refine the feature subset. This method selects highly informative features for classifiers, which mitigates model aging by ensuring the focus on relevant and stable features, thus maintaining accuracy and robustness over time. We implemented this feature selection approach across several baseline classifiers to assess its effectiveness. Results demonstrate that RFI not only significantly boosts the accuracy of classifiers on our datasets but also considerably reduces computational overhead compared to existing traditional and innovative feature selection methods. Specifically, RFI achieves an accuracy improvement of up to 12.79% over baseline feature selection methods while reducing computational time by approximately 22.22% compared to dynamic-only approaches.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

RFI: Enhancing Network Intrusion Detection Through Robust Feature Selection Techniques

  • Cunxin Li,
  • Hongbing Cheng,
  • Jie Gao,
  • Wei Li

摘要

Machine learning (ML) classifiers have been widely applied in network intrusion detection recently, but at the same time, the application of ML classifiers also faces an emerging serious problem, which is the performance of these ML classifiers degrades over time due to the evolving nature of network attacks. Existing ML intrusion detection models typically mitigate this aging with costly retraining and active learning, yet they overlook how redundant and irrelevant features exacerbate the aging process. This paper introduces a novel feature selection algorithm, Robust Feature Integration (RFI), which innovatively combines dynamic and static feature selection. RFI first uses static feature selection based on feature correlation to reduce the number of features, then applies conditional mutual information in a greedy policy for dynamic feature selection to further refine the feature subset. This method selects highly informative features for classifiers, which mitigates model aging by ensuring the focus on relevant and stable features, thus maintaining accuracy and robustness over time. We implemented this feature selection approach across several baseline classifiers to assess its effectiveness. Results demonstrate that RFI not only significantly boosts the accuracy of classifiers on our datasets but also considerably reduces computational overhead compared to existing traditional and innovative feature selection methods. Specifically, RFI achieves an accuracy improvement of up to 12.79% over baseline feature selection methods while reducing computational time by approximately 22.22% compared to dynamic-only approaches.