Feature Selection for Modeling Intrusion Detection

Published Online June 2014 in MECS

With the wide and quick development of network technology, in the field of social networking, e-business, e-learning and online shopping, Security is a big issue for all networks in today’s enterprise environment. Hackers and intruders have made many successful attempts to bring down high-profile company networks and web services. Many methods have been developed to secure the network infrastructure and communication over Internet. Some of them are the use of firewalls, encryption, and virtual private networks. Intrusion detection is a relatively new addition to such techniques. Intrusion detection methods with machine intelligence started appearing in the last few years. Using intrusion detection methods, you can collect and use information from known types of attacks and find out if someone is trying to attack your network or particular hosts.

An Intrusion Detection System (IDS) is the device (or application) that monitors network/system activities and the analyzing of data for potential vulnerabilities and attacks in progress; it also raises alarm or produces report [1]. Different sources of information and events based on information are gathered to decide whether intrusion has taken place. This information is gathered at various levels like system, host, application, etc [2]. Based on analysis of this data, we can detect the intrusion based on two common practices – Misuse detection and Anomaly detection.

Misuse detection IDS models function in very much the same sense as high-end computer anti-virus applications. That is, misuse detection IDS models analyze the system or network environment and compare the activity against signatures (or patterns) of known intrusive computer and network behavior [3].

Anomaly detection takes the normal observation model and uses statistical variance [4] or expert systems to determine if the system or network environment behavior is running normally or abnormally.

The paper is organized as follows. Section 2 in our paper gives brief idea of the work done in this field i.e. intrusion detection using data mining and feature selection for it. In Section 3, we give brief detail of probability based Naïve Bayesian model, Decision Table and various attribute selection scheme used in the experiments. In Section 4, we discuss the dataset used and experiment results in detail. Finally, we concluded the whole work in Section 5.

• II.    Related Work

IDS have become important and widely used for ensuring network security. Since the amount of audit data that an IDS needs to examine is very large even for a small network, analysis is difficult even with computer assistance because extraneous features can make it harder to detect suspicious behavior patterns [5][9].

Data mining approaches can be used to extract features and compute detection model from the vast amount of audit data. The features computed from the data can be more objective than the ones handpicked by experts. The inductively learned detection model can be more generalized than hand-coded rules (that is they can have better performance against new variants of known normal behavior or intrusions). Therefore data mining approaches can play an important role in process of developing Intrusion Detection Systems. Complex relationships exist between the features and IDS must therefore reduce the amount of data to be processed. This is very important if real-time detection is desired. Reduction can occur by data filtering, data clustering and feature selection. In complex classification domains, features may contain false correlations, which hinder the process of detecting intrusions. Extra features can increase computation time, and can have an impact on the accuracy of IDS.

Feature selection improves classification by searching for the subset of features, which best classifies the training data. In the literature a number of work could be cited wherein several machine learning paradigms, fuzzy inference systems and expert systems, were used to develop IDS [5][6].