An approach to reduce data dimension in building effective Network Intrusion Detection Systems

Abstract

The main function of the network Intrusion Detection System (IDS) is to protect the system, analyze and predict network access behavior of users. These behaviors are considered normal or an attack. Machine learning methods (ML) are used in IDSs because of the ability to learn from past attack patterns to recognize new attack patterns. These methods are effective but have relatively high computational costs. Meanwhile, the traffic of network data is growing rapidly, the computational cost issues need to be addressed. This paper addresses the use of algorithms combined with information metrics to reduce the features of the dataset to be analyzed. As the result, it helps to build IDSs with lower cost but higher performance suitable for large scale networks. The test results on the UNSW-NB15 dataset demonstrate: with the optimal set of features suitable for the attack type as well as the machine learning method, the quality of classification is improved with less training and testing time.