Using attack-specific feature subsets for network intrusion detection

Abstract

One of the essential tasks for building a network intrusion detection system might be to differentiate a salient feature subset from noisy and/or redundant features. Especially, in real-time environment too many features to be monitored deteriorate the system performance. In this paper, we focus on extracting robust feature subsets that maximizes inter-classes seperability with minimized subset size based on a genetic algorithm-based optimization, reducing both false positive and false negative errors by learning class-specific feature subsets. Experimental results show that the proposed approach is especially effective in detecting totally unknown attack patterns compared with single feature-subset model. © Springer-Verlag Berlin Heidelberg 2006.