Hybrid feature selection for modeling intrusion detection systems

Most of the current Intrusion Detection Systems (IDS) examine all data features to detect intrusion or misuse patterns. Some of the features may be redundant or contribute little (if anything) to the detection process. We investigated the performance of two feature selection algorithms involving Bayesian Networks (BN) and Classification and Regression Trees (CART) and an ensemble of BN and CART. An hybrid architecture is further proposed by combining different feature selection algorithms. Empirical results indicate that significant input feature selection is important to design an IDS that is lightweight, efficient and effective for real world detection systems.