Research On Network Intrusion Detection Method Based On Feature Selection

In the background of Internet of Things with big data,various network attacks also increase,which makes network security a key research direction.Since intrusions are the major threat to network security,intrusion detection systems become more and more important.Data preprocessing includes data normalization and feature selection,which is an important step of intrusion detection and will affect the efficiency and performance of intrusion detection.A network intrusion detection system based on feature selection is proposed in this paper.Support Vector Machine(SVM)based on nonlinear normalization is the core classification model of our detection system.For different data sets,the impact of different data preprocessing methods on intrusion detection performance is studied.For the NSL-KDD dataset,nonlinear scaling methods and different kernel functions are combined to select the optimal SVM model.Besides,principal component analysis is proposed for feature selection.The results after feature selection are compared with the ones before feature selection.For binary classification,we select 16 features,achieving the accuracy of82.2%,which is equal to the result of 41 features before feature selection.In addition,the testing time is reduced by 20%.For multi-classification,we select 29 features,achieving 78.3% accuracy in detection rate and 20%reduction in testing time.For the UNSW-NB15 dataset,log scaling and radial basis kernel are chosen in the SVM classification model.The accuracy of binary classification is 85.99%,which is 7.52% higher than ExpectationMaximization algorithm.For multi-classification,the accuracy is 75.77%,which is 6.17% higher than Na?ve Bayes algorithm.In addition,Principal Component Analysis,Gain Ratio and Pearson's correlation coefficient are used for feature selection in this paper.The results show that Gain Ratio method with 24 features performs best,reaching the accuracy of 86.33% for binary classification and 75.80% for multi-classification.Besides,research also shows that the proposed intrusion detection system is more effective to identify abnormal instances.