Cyberattack feature selection using correlation-based feature selection method in an intrusion detection system

Abstract

An intrusion detection system (IDS) is software or hardware that works as a monitoring and defense system against cyberattacks. This system monitors computer systems or network activities that have the potential to violate security policies. In general, there are two techniques used by an IDS in its cyberattack detection system: signature-based and anomaly-based. However, these techniques still face some problems, such as false alarm warnings, low accuracy and precision rates, high-dimensional data, complex data structures, and long computational times. IDS performance can be improved by implementing feature selection, which can reduce the amount of data to be processed on the IDS detection engine. This research used correlation-based feature selection (CFS). Experimental results on CIC-IDS2018 dataset show optimal IDS performance. The proposed CFS-based IDS achieves an accuracy of 99.9995%, recall of 100%, specificity of 99.9985%, precision of 99.9992, F1-score of 99.9996%, true positive rate of 99.9992%, and true negative rate of 100%.