A Comparison of Feature-Selection Methods for Intrusion Detection

Feature selection is an important pre-processing step in intrusion detection Achieving reduction of the number of relevant traffic features without negative effect on classification accuracy is a goal that greatly improves overall effectiveness of an intrusion detection system A major challenge is to choose appropriate feature-selection methods that can precisely determine the relevance of features to the intrusion detection task and the redundancy between features Two new feature selection measures suitable for the intrusion detection task have been proposed recently [11,12] the correlation-feature-selection (CFS) measure and the minimal-redundancy-maximal-relevance (mRMR) measure In this paper, we validate these feature selection measures by comparing them with various previously known automatic feature-selection algorithms for intrusion detection The feature-selection algorithms involved in this comparison are the previously known SVM-wrapper, Markov-blanket and Classification & Regression Trees (CART) algorithms as well as the recently proposed generic-feature-selection (GeFS) method with 2 instances applicable in intrusion detection the correlation-feature-selection (GeFSCFS) and the minimal-redundancy-maximal-relevance (GeFSmRMR) measures Experimental results obtained over the KDD CUP'99 data set show that the generic-feature-selection (GeFS) method for intrusion detection outperforms the existing approaches by removing more than 30% of redundant features from the original data set, while keeping or yielding an even better classification accuracy