论文标题
使用基于包装器的决策树进行特征选择的网络入侵检测
Network Intrusion Detection Using Wrapper-based Decision Tree for Feature Selection
论文作者
论文摘要
基于机器学习（ML）的入侵检测系统（IDS）的关键挑战之一是昂贵的计算复杂性，这在很大程度上是由于IDS数据集中包含的冗余，不完整且无关紧要的功能。为了克服此类挑战并确保建立有效，更准确的IDS模型，许多研究人员在混合建模方法中使用了预处理技术，例如归一化和特征选择。在这项工作中，我们提出了一种使用用于功能选择（FS）的算法的混合IDS建模方法，而另一个用于构建ID的算法。 FS算法是基于包装的，具有决策树作为功能评估器。建议的FS方法与一些选定的ML算法结合使用，用于使用UNSW-NB15数据集构建IDS模型。一些IDS模型是在单个建模方法中使用数据集的完整功能构建的。我们通过将其与基线模型以及最新作品进行比较来评估我们提出的方法的有效性。我们的方法达到了97.95％的最佳DR，与最先进的作品相比，它非常有效。因此，我们建议使用UNSW-NB15数据集在IDS建模中使用它的用法。
One of the key challenges of machine learning (ML) based intrusion detection system (IDS) is the expensive computational complexity which is largely due to redundant, incomplete, and irrelevant features contain in the IDS datasets. To overcome such challenge and ensure building an efficient and more accurate IDS models, many researchers utilize preprocessing techniques such as normalization and feature selection in a hybrid modeling approach. In this work, we propose a hybrid IDS modeling approach with an algorithm for feature selection (FS) and another for building an IDS. The FS algorithm is a wrapper-based with a decision tree as the feature evaluator. The propose FS method is used in combination with some selected ML algorithms to build IDS models using the UNSW-NB15 dataset. Some IDS models are built as a baseline in a single modeling approach using the full features of the dataset. We evaluate the effectiveness of our propose method by comparing it with the baseline models and also with state-of-the-art works. Our method achieves the best DR of 97.95% and shown to be quite effective in comparison to state-of-the-art works. We, therefore, recommend its usage especially in IDS modeling with the UNSW-NB15 dataset.
