Feature Selection for Anomaly-Based Intrusion Detection System Using Information Gain and Mutual Correlation

Abstract

To avoid high computational costs in identifying intrusions by IDSs, the size of a dataset needs to be reduced. Feature selection is considered a problem of global combinatorial optimization in machine learning, which reduces the number of features, removes irrelevant, noisy and redundant data, and results in acceptable classification accuracy. This paper proposes a combine filter method by using IG (information gain) and Mutual Correlation for feature selection in NSL-KDD dataset. IG was used to select important feature subsets from all features in the NSL-KDD dataset. The resulted features set are combined with Mutual correlation to get the optimal reduced features set. Tests are done on NSL-KDD dataset which is improved version of KDD-99 dataset. The results show that the number of selected features is reduced from 41 to 14 and correlated 10 features. The proposed method not only reduces the number of the input features and memory and CPU time but also increases the classification accuracy.