Introduction
In today’s interconnected digital landscape, computer systems and networks’ security is paramount. With the proliferation of cyber threats, ranging from malware attacks to data breaches, organizations face significant challenges in protecting their sensitive information and ensuring the integrity of their operations. Intrusion detection systems (IDS) serve as a frontline defense mecha-
* Correspondence: Associate Professor, Department of Computer Science and Engineering, RISE Krishna Sai Prakasam Group of Institutions, Ongole, Andhra Pradesh, India. Email:jyothiendluri@gmail.com https://doi.org/10.58599/IJSMCSE.2024.1106
Vol. 1, No. 1, June 2024, pp:9-16
9
This work is licensed under a Creative Commons Attribution 4.0 International License CC BY-NC-ND 4.0.
nism, continuously monitoring network traffic and system activities to identify and thwart malicious activities in real time. However, the effectiveness of IDS relies heavily on the accuracy of the features used to characterize normal and anomalous behavior. Traditional intrusion detection approaches often suffer from the curse of dimensionality, where the high number of features in the dataset leads to increased computational complexity and reduced detection accuracy. Feature selection techniques aim to alleviate this problem by identifying a subset of relevant features that capture the essential characteristics of normal and abnormal network behavior. By focusing on the most informative features, IDS can achieve higher detection rates while minimizing false alarms and computational overhead. Data mining, a multidisciplinary field at the intersection of statistics, machine learning, and database systems, offers a rich set of tools and techniques for analyzing large datasets and extracting actionable insights. However, in the context of intrusion detection, the selection of an appropriate data mining algorithm and the optimization of feature selection parameters pose signifi- cant challenges. These challenges require careful consideration of factors such as detection accuracy, computational efficiency, and robustness to different types of attacks. Our proposed approach aims to address these challenges and enhance the performance and scalability of IDS. In this paper, we present a novel approach that optimizes feature selection in intrusion detection algorithms using data mining techniques. Our approach is unique in its systematic exploration of various data min- ing algorithms and evaluation of their effectiveness in identifying the most discriminative features for intrusion detection. By leveraging the synergy between data mining and cybersecurity, our approach aims to enhance the resilience of IDS against emerging threats and improve the overall security posture of organizations operating in today’s digital environment.
Related Works
When the font name says that you should use Times Roman or Times New Roman, you can utilize one of those fonts. Please use the typeface that most closely resembles Times if neither font is available on your word processor. Thank you for your cooperation. Bit-mapped typefaces should be avoided at all costs. You have to utilize fonts that are Open Type or True-Type 1. For mathematics and other subjects of a similar nature, symbol typefaces should also be incorporated. These systems are incredibly incorrect and inefficient in their operation. A few of the most common threats can affect network resources [1]. These threats include Denial of Service, remote-to-local (R2L), Probe, and user to root attack (U2R). Intrusion detection systems are confronted with several issues, two of the most significant of which are the ability to reliably detect malicious behavior and the ability to keep up with the growing volumes of business traffic [2].They comprehensively explain the process of developing an effective intrusion detection system by utilizing powerful algorithms [3]. Find suspicious activity in the traffic on the network and stop unauthorized users from accessing the resources on the network from being accessed. Although several interruption identification
They have described it. Intrusion detection systems prevent unauthorized access to computer systems, networks, and databases. Harsh Set Trait Decrease Calculation is one of the fundamen- tal ideas utilized to minimize attributes successfully by removing redundancy. They describe the process that should be followed to select the fewest feasible Knowledge Disscovery in Databases (KDD) attributes [5]. The minimal redundancy-maximal-relevance (mRMR) measure and the
correlationfeature-selection measure are two fundamental estimations that are taken into consid- eration in the channel model. Both of these measures are stated as being checked from top to bottom. By weaving the metrics together, we demonstrated that they can be combined into a
standard element determination (GeFS) measure [6]. A branch-and-bound algorithm solution to a mixed 0-1 linear programming problem (M01LP) inspired the unique method. They have described it. An algorithm known as an ICRF-based Cuttlefish Feature Selection Algorithm (ICRFCFA) is recommended for effective decision-making on healthcare datasets [7]. It is helpful to incorporate the highlighted determination computation proposed to speed up the anticipated improvement in accuracy [8]. Future work in this field may consist of the creation of innovative criteria for the selection of efficient features [9].
Methodology
This specific module consists of an element choice agent and a data set. The data utilized for the KDD Cup’99 was collected via the feature selection module. This set contains 41 features. Using the criteria recorded in the knowledge base, the agent in charge of feature selection chooses the best combination of these 41 features in Figure 1. The word ”knowledge base” comes from the fact that it is a compilation of data that includes the features’ attributes. Another helpful feature is incorporating the CRF model’s freshly created rules into the training phase [10, 11]. The feature selection agent looks up the appropriate characteristics in the knowledge base to determine which laws are most relevant. Users can choose the KDD’99 cup set that comprises the ideal combination of features, which is the most significant benefit of this feature selection module. It accomplishes this by classifying the data according to a predetermined set of rules. The layered approach (LA) is used to construct these criteria all through the course. Identifying common data and attacks is possible by sticking closely to the standards [12, 13]. Also, the requirements help categorize the many kinds of assaults found during testing. This module mainly consists of the training agent and the decision-making agent. Investigative, denial-of-service, R2L, and U2R attack layer framing is the responsibility of the training agent. The agent making decisions can use information and regulations to conclude. This module can only generate two possible outcomes: an average outcome
or an attack. A Probe attack, DoS attack, R2L attack, or U2R attack are all forms of assault. Any one of these kinds of attacks could be used [14]. The dataset used by this agent for training is based on LA and has fewer features than other datasets. The training agent is also responsible for establishing the classification criteria for the knowledge base[15]. The LA, through the use of a four-layer technique, identifies four distinct types of attacks[16].
Figure 1. A visual illustration of CRF
Method for Sorting Data Applying LA: Within the scope of this investigation, we utilized the widely-utilized LA classifier in conjunction with the ICRFFSA feature-selecting technique to accomplish accurate classification. During the training phase, the data that has been reduced in characteristics is inputted into the suggested algorithm. Once the computation for element determination has been completed, it is validated by using the rules and facts already present in the knowledge base. This model defines four distinct types of attacks, each derived from the concepts discovered in the knowledge base. When the individuals responsible for the assaults have been identified, this classifier will then determine the nature of the attacks.
Results and Discussion
We chose different functions for the other layers in reaction to the type of attack identified by the training layer. This is done about the four assault groups (Probe, DoS, R2L, and U2R) provided by the KDD 99 dataset and alternative attacks. One dedicated module is assigned to each of the four assault groups, and a fifth module is trained on additional assaults that were not included in the four assault groups that were included in the training dataset. To accomplish the goal of teaching the various levels of the framework, we choose different functions in Table 1. Accordingly, we use
Table 1. Intrusion attack performance on the training set
Attack | Precision Rate | Recall Rate |
R2L | 88.7434 | 88. 7434 |
DOS | 82. 7434 | 80. 7434 |
Normal | 86. 7434 | 85. 7434 |
U2R | 87. 7434 | 86. 7434 |
Probe | 86. 7434 | 83. 7434 |
our domain expertise to select the suitable function for each attack. Afterward, we will dissect the logic underpinning the process of selecting features for each level of the layered architecture.
This type of attack occurs when a malicious actor blocks authorized users from accessing the system or when they make a computer or memory resource too busy to handle the requests they have made. This is Gram. Neptune, Earth, Smurfs, Teardrops, and Pods are all involved in Figure 2 and Figure 3.
Figure 2. Precision Rate
In a reconnaissance assault, an attacker without a record on the remote computer uses network packets to acquire proximate access as a client of that system by exploiting specific vulnerabilities. Examples include spy, warezclient, warezmaster, write to FTP, and guess password. The choice between prioritizing precision or recall depends on the specific use case and the environment in which the intrusion detection system is deployed. For instance, in a highly secure environment, high recall might be prioritized to ensure no threats go undetected, while in a more resource- constrained environment, high precision might be more important to reduce the burden on security personnel.
