Feature Selection of The Anomaly Network Intrusion Detection Based on Restoration Particle Swarm Optimization

Abstract

Intrusion detection systems are vital for detecting networking attacks due to their ability to analyze network data and find different types of attacks. The high-dimensional internet data leads to feature selection becoming a fundamental process in network intrusion detection systems. The current approaches are insufficient to determine the most effective features in the network data due to the nature of intrusion attacks appearance compared to the normal data. Moreover, the wrapper feature selection methods suffer from the search time complexity such as the standard PSO algorithm for feature selection. The standard Particle Swarms Optimization (PSO) algorithm suffers from the stagnation effect in local optima. This paper proposes a new wrapper feature selection model called Restoration Particle Swarms Optimization (RPSO) to select highly relevant feature data taking into consideration the limitation of the premature convergence between the particles which results in a stagnation problem during the iteration for the optimal features. Moreover, we utilize the randomness value to overcome the stagnation problem, reduce data volume and decrease the processing time. The Random Forest algorithm uses to classify the feature selected with our solution. As a result, we consider the NSL-KDD benchmark dataset to evaluate the proposed solution. The experiments show that the performance evaluation achieves high results in general accuracy (85%) compared to standard PSO up to 83.86%. Additionally, the results show that the proposed solution increased the detecting rate of low distributing classes in the training data up to (521 classes) compared with standard PSO by (79 classes).