Feature selection approach using ensemble learning for network anomaly detection. Issue 4 (5th November 2020)

• Record Type: Journal Article
• Authors: Doreswamy, ; Hooshmand, Mohammad Kazim; Gad, Ibrahim
• Is Part Of: CAAI transactions on intelligence technology. Volume 5:Issue 4(2020)
• Page Start: 283
• Page End: 293
• Publication Date: 2020-11-05
• Subjects: feature selection -- decision trees -- data mining -- pattern classification -- security of data -- support vector machines -- Bayes methods -- feature extraction -- regression analysis -- random forests; machine learning algorithms -- primary individual selection methods -- recursive feature elimination -- absolute selection -- shrinkage operator -- discard redundant features -- individual methods -- equalise individual feature sets -- equalised individual feature sets -- quorum techniques -- network anomaly detection -- random forest -- quorum feature -- feature selection approach -- ensemble learning; Artificial intelligence -- Periodicals; Computer science -- Periodicals; Artificial intelligence; Computer science; Electronic journals; Periodicals; 006.305
• DOI: 10.1049/trit.2020.0073
• Languages: English
• ISSNs: 2468-6557

Abstract

Abstract : Feature selection is essential for prioritising important attributes in data to improve prediction quality in machine learning algorithms. As different selection techniques identify different feature sets, relying on a single method may result in risky decisions. The authors propose an ensemble approach using union and quorum combination techniques with five primary individual selection methods which are analysis of variance, variance threshold, sequential backward search, recursive feature elimination, and least absolute selection and shrinkage operator. The proposed method reduces features in three rounds: (i) discard redundant features using pairwise correlation, (ii) individual methods select their own feature sets independently, and (iii) equalise individual feature sets. The equalised individual feature sets are combined using union and quorum techniques. Both the combined and individual sets are tested for network anomaly detection using random forest, decision tree, K‐nearest neighbours, Gaussian Naive Bayes, and logistic regression classifiers. The experimental results on the UNSW‐NB15 data set show that random forest with union and quorum feature sets yields 99 and 99.02% f1_score with minimum 6 and 12 features, respectively. The results on the NSL‐KDD data set show that random forest with union and quorum gets 99.34 and 99.21% f1_score with a minimum of 28 and 18 features.