Analysis of feature selection techniques for correlation-based network anomaly detection

Abstract

Although the application of feature selection techniques is common practice for performance enhancements of network anomaly detection techniques, it has rarely been used for recently proposed multivariate correlation-based methods. This paper investigates qualitatively why this is the case and evaluates several feature selection techniques empirically in combination with the state-of-the-art multivariate correlation anomaly detection technique on the UNSW-NB15 network intrusion detection dataset. Our results show that there is a significant enhancement possibility using feature selection techniques. Furthermore, we believe that if the underlying nature of multivariate correlation techniques, temporal correlation changes between attributes, is considered in the selection process the performance could be further improved.