On Attack-Relevant Ranking of Network Features

An Intrusion Detection System (IDS) is an important component of the defense-in-depth security mechanism in any computer network system. For assuring timely detection of intrusions from millions of connection records, it is important to reduce the number of connection features examined by the IDS, using feature selection or feature reduction techniques. In this scope, this paper presents the first application of a distinctive feature selection method based on neural networks to the problem of intrusion detection, in order to determine the most relevant network features, which is an important step towards constructing a lightweight anomaly-based intrusion detection system. The same procedure is used for feature selection and for attack detection, which gives more consistency to the method. We apply this method to a case study, on KDD dataset and show its advantages compared to some existing feature selection approaches. We then measure its dependence to the network architecture and the learning database.

@article{Ammar2015,
  title     = {On Attack-Relevant Ranking of Network Features},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {6},
  number    = {11},
  year      = {2015},
  publisher = {The Science and Information Organization},
  author    = {Adel Ammar and Khaled Al-Shalfan},
  doi       = {10.14569/IJACSA.2015.061130},
  url       = {https://doi.org/10.14569/IJACSA.2015.061130}
}