{'fraction_non_alphanumeric': 0.025205070842654734, 'fraction_numerical': 0.00820283370618941, 'mean_word_length': 5.071072883657764, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Hybrid feature selection for supporting lightweight intrusion detection systems

Redundant and irrelevant features not only cause high resource consumption but also degrade the performance of Intrusion Detection Systems (IDS), especially when coping with big data. These features slow down the process of training and testing in network traffic classification. Therefore, a hybrid feature selection approach in combination with wrapper and filter selection is designed in this paper to build a lightweight intrusion detection system. Two main phases are involved in this method. The first phase conducts a preliminary search for an optimal subset of features, in which the chi-square feature selection is utilized. The selected set of features from the previous phase is further refined in the second phase in a wrapper manner, in which the Random Forest(RF) is used to guide the selection process and retain an optimized set of features. After that, we build an RF-based detection model and make a fair comparison with other approaches. The experimental results on NSL-KDD datasets show that our approach results are in higher detection accuracy as well as faster training and testing processes.


Introduction
Intrusion detection is the process of observing the events occurred in the network or computer systems and examining them for signs of possible events that violate the security policies or security standard practices [1]. Intrusion Detection Systems (IDS) have become important and widely-used tools for ensuring network security. Since the amount of audit data that an IDS needs to examine is very large even for a small network, analysis work becomes difficult for harder detection of suspicious behaviour pattern with extraneous features [2]. IDS must reduce the amount of data to be processed to improve detection efficiency, which desires a lightweight detection system. Feature selection is one of the important and frequently-used techniques in data preprocessing for intrusion detection systems [3]. It reduces the number of features, removes irrelevant, redundant or noisy data, and brings the immediate effects for applications.
Many literatures have tried to figure out important features in order to minimize overhead of detection models and maximize detection rates. Dong et al. [4] proposed a feature selection method based on Genetic Algorithm (GA) and Support Vector Machine (SVM). Hai et al. [5] proposed an automatic feature selection procedure based on Correlation Feature Selection (CFS). Zhu et al. [6] a binary feature selection (BFS) framework in kernel spaces, where each feature is projected into kernel spaces and a binary classification task is constructed in this space. Ambusaidi et al. [7] proposed a mutual information based algorithm that analytically selects the optimal features for intrusion detection. Tama et al. [8] combined particle swarm optimization and correlation-based feature selection (PSO-CFS) with tree-based classifiers for detection task. Thaseen et al. [9] designed an intrusion detection model using fusion of chi-square feature selection and multi class SVM. Dong  measure of feature importance. Besides this, some PCA (Principal Component Analysis) and ICA (Independent Component Analysis) approaches also have been proposed to decrease overhead of IDS and increase the detection rates [11]. Those methods can fall into two categories: filter and wrapper. Filter methods utilize the underlying characteristics of the training data to evaluate the relevance of the features by some independent measures such as distance measure, correlation measures and consistency measures [12] [13]. It is more lightweight than wrapper method in terms of computation time and overheads since it is performed independent of classification algorithms. However, their results are not always acceptable. Due to the lack of interaction between the classifier and the dependence among features, filter methods might fail to choose the best available subset or might select redundant features [14]. Wrapper method exploits a machine learning algorithm as a fitness function to evaluate the goodness of features. It provides better performance of selecting suitable features since it employs performance of learning algorithm as an evaluation criterion. In comparison with filter methods, wrapper methods are argued to be more accurate. However, the wrapper approaches are often computationally more complicated when dealing with large sets of features than the filter approaches [15].
To cope with the aforementioned drawbacks, we propose to adopt the principle of chi-square feature selection and RF algorithm to build a lightweight intrusion detection model in a hybrid manner. The proposed approach is able not only to significantly decrease training and testing time while retaining high detection rates but also to figure out important features simultaneously. Then, we design an RF-based detection model framework with the proposed hybrid feature selection method and conduct several experiments on intrusion detection benchmark. The experimental results on NSL-KDD datasets indicate the feasibility of our method. This paper is organized as follows. In Section 2, the proposed hybrid feature selection approach is introduced. Experiments and results are presented in Section 3. Finally, the paper is concluded in Section 4.

Hybrid Feature Selection Method
In this section, we introduce the proposed hybrid feature selection method which utilizes both filter and wrapper methods. The framework of the approach is depicted in figure 1. It consists two stages: the first stage at which the chi-square statistics is used for feature ranking and elimination, and the second stage which determines the optimal subset using RF algorithm, and contributes maximum classification accuracy on training dataset.

Filter Method for Feature Pre-Selection
The 2  method [16] evaluates features individually by measuring their chi-square statistic with respect to the class labels. The 2  value of a feature is defined as: After calculating the 2  value of all considered features in each sample, these values can be sorted with the largest one at the first position, as the larger the 2  value, the more important the feature is. This will provide an ordered ranking of features, and a threshold needs to be established. The filtering process is applied to eliminate irrelevant and redundant features from the initial set. This helps the wrapper method-based feature selection to narrow the searching range from the entire original feature space to the pre-selected features.

Wrapper Feature Selection Using RF
Random Forests builds an ensemble of CART (Classification and Regression Tree) tree classifications using bagging mechanism [17]. By using bagging, each node of trees only selects a small subset of features for the split, which enables the algorithm to create classifiers for high dimensional data very quickly. This somewhat counterintuitive strategy turns out to perform very well, compared with the state-of-the-art methods in classification and regression. Also, RF produces additional facilities, especially the feature importance by numerical values [18].
Once the filter method finishes its task, the second stage evaluates the candidate feature subsets, using wrapper scheme, to determine the optimal subset of feature that can produce the best classification performance. To do so, RF and the classification accuracy are employed. If the performance reaches the best accuracy rate, the selection process is completed while outputs the last optimal subset of features. The procedure is specified as follows: (i) Delete one input attribute from the data.
(ii) The resultant data are used for training.
(iii) The results of the classifier are analyzed using the performance metrics.
(iv) The rules are used to rank the attribute by its importance level.
(v) Repeat the steps (i) to (IV) for each of the features.

RF-Based Intrusion Detection Framework
In this paper, for demonstrating the efficiency and effectiveness of our approach, we build an intrusion detection model based on RF using the features selected by our proposed hybrid feature selection method. The overall architecture of the model is depicted in figure 2.

Experiments and Results
All experiments were performed in a Win7 OS having configurations Intel(R) Core(TM) i7-4790K CPU@4.00GZ, 16GB RAM. We have used RF version in an open machine learning library scikitlearn using Python programming language [19] [20].

Description of the Benchmark Dataset
The NSL-KDD dataset was proposed by Tavallaee et al. [21], which is a new revised version of the KDD Cup 99 dataset. The important deficiency in the KDD Cup 99 dataset is the huge number of redundant records that will cause learning algorithms to be biased towards the more frequent records, and thus prevent it from learning infrequent records. The existence of these repeated records in the test set, on the other hand, will cause the evaluation results to be biased by the methods which have better detection rates on the frequent records [21]. The provided NSL-KDD dataset does not suffer from any of the mentioned problems. Furthermore, the number of records in the train and test sets is reasonable. This advantage makes it affordable to run the experiments on the complete set without the need to randomly select a small portion. Consequently, evaluation results of different research work will be consistent and comparable. The total number of records in the training dataset is 125973, where 67343 records are normal data and the rest indicate attacks. The total number of features is 41, which include numerical, nominal, and binary features. This dataset consists of five different classes, where one shows normal behavior and the rest indicate attacks. Attacks are categorized as DoS, Probe, R2L, and U2R. The test set consists of 22544 records. In this paper, 20% percent of the full training data is applied to the proposed method. Furthermore, to validate the performance of our hybrid feature selection, we test our RF-based detection model with the proposed hybrid feature selection on KDDTest-21 dataset and make a comparison with other detection model.

Performance Metrics
In this paper, we classify the dataset into two main classes: normal and abnormal. In order to classify them, we use RF to train a binary classifier. Several experiments have been conducted to evaluate the performance of the proposed method. For this purpose, the accuracy rate, detection rate, and Fmeasure metric are applied, and they are defined by: weights to both Precision and Recall, and is given by: The Precision is the ratio of items correctly classified as X to all items classified as X. A higher value of precision means a lower false positive rate and vice versa. The Recall is another important value for measuring the performance of the detection system and to indicate ratio of items correctly classified as X to all items that belong to class X [22].

Experimental Results and Analysis
We compare the results of the RF-based detection model using the proposed hybrid feature selection method with the detection model using all 41 features and the chi-square filter algorithm only.
Features selected by the aforementioned three feature selection methods are listed in Table 1. Table 2 summarizes the classification results of the different selection methods with respect to detection rate, accuracy and F-measure. Through Table 2, we can see that our detection model with the proposed hybrid method achieve the highest accuracy rates of 80.07%. In addition, the proposed approach achieve detection rate of 71.21%. In general, in terms of the F-measure results for all methods, the detection model with the proposed hybrid feature selection enjoys higher rates. Table 3 shows the average training and testing time of the detection model with the proposed hybrid feature selection, compared with using only filter method and those using all 41 features. It can be observed that the proposed approach illustrates the best average time of building and testing processes. experiments have been conducted to make comparisons with some state-of-the-art detection model on the KDD Test+ dataset. The results illustrates in figure 3 strongly indicate that the proposed detection model shows promising results compared with other models. Regarding the results obtained by [21], it can be seen that the proposed approach enjoys the best accuracy and our proposed method can significantly improve the classification performance (up to 12.38 % improved) compared with other six competitors.

Conclusion
In this paper, for building a lightweight intrusion detection model, a hybrid feature selection approach combining the filter and wrapper selection processes is proposed to achieve more accurate detection as well as fast training and testing process. It contains two stages: (1) chi-square filter feature eliminating phase; and (2) wrapper feature selection using RF. Experiments on the NSL-KDD Test+ dataset exhibit promising results in terms of classification accuracy, low computational cost and F-measure. In addition, compared with those models that have been evaluated on the NSL-KDD Test-21 dataset, the RF-based detection model with the proposed hybrid method shows good a comparable result in terms of detection accuracy.