Hybrid feature selection strategies for strong network intrusion detection

Abstract

High dimensional network traffic datasets pose great challenges to network intrusion detection systems (NIDS) due to redundant and irrelevant features, which decrease detection accuracy and increase the computational cost. Traditional feature selection methods often cannot achieve a balance between classification performance and processing efficiency. This paper proposes hybrid feature selection for network intrusion detection systems (HybFS-NIDS), a hybrid feature selection framework using filter- and wrapper-based optimization methods to detect the most significant intrusion detection features to do this. The proposed model was evaluated on the CIC-IDS2017 dataset using performance metrics such as accuracy, precision, recall, F1-score, and Matthew’s correlation coefficient (MCC). The experimental results selected 18 optimal features from the initial 78 features of the dataset and achieved 90.68% accuracy, 91.74% precision, 90.64% recall, 91.19% F1-score, and an MCC of 0.9148. The proposed method also achieved a 41.5% reduction in training time compared with the full-feature baseline model while improving the overall classification performance. The results show that HybFS-NIDS can successfully improve the efficiency of intrusion detection and fit for real-time cybersecurity applications with a large amount of network traffic data.