Category-Based Selection of Effective Parameters for Intrusion Detection

Existing intrusion detection techniques emphasize on building intrusion detection model based on all features provided. In feature-based intrusion detection, some selected features may found to be redundant and useless. Feature selection can reduce the computation power requirements and model complexity. This paper proposes a category-based selection of effective parameters for intrusion detection using principal components analysis method. In this paper, 32 basic features are selected from TCP/IP header. Tcpdump from DARPA 1998 dataset is used in the experiments as the test data. Principal Components Analysis (PCA) method is used to determine an optimal feature set. Experimental results show that feature reduction can improve detection rate for the category-based detection approach while maintaining the detection accuracy within an acceptable range. Feature reduction will speed up the training and the testing processes for the attack identification system considerably. Results presented in this paper show that normal state of the network and category of the attacks can be identified using a small number of a carefully selected network features.