Application Of Hybrid Filter And Wrapper Feature Selection Algorithm In IDS

As a complementary method of network security technology,Intrusion Detection System(IDS)makes up for the difficult situation that traditional security technologies are difficult to effectively cope with the current network security.This system can detect attacks and intrusions in the network,analyze the information collected from several key nodes,detect whether there are network security problems,and handle suspicious attacks to ensure network security.IDS often faces massive amounts of high-dimensional data,which will seriously affect the performance of IDS.Studies have shown that there is a serious overlap between the most important features,using the most important features can produce the same effect as using all features.Training and detection time can be reduced by eliminating redundant and uncorrelated features,which helps reduce the cost of acquiring data and makes the classification model easier to understand.Therefore,we need to select some representative features from the original feature set to reduce the number of features,and improve the efficiency and performance of IDS without sacrificing the prediction accuracy,which is the problem of feature selection.The purpose of feature selection research is to obtain low falsepositive rates,high precision and short time detection.It can usually be divided into three categories: Filter,Wrapper,and Embedded.The Filter method has strong universality and can quickly remove irrelevant features,but the classification effect is poor.The Wrapper method is highly accurate but computationally complex and slow.In order to solve these problems,the paper focuses on the in-depth study of the respective advantages of the two methods.The third chapter of this paper proposes the application of feature selection method based on hybrid Filter and Wrapper in IDS.Firstly,Fisher score and Relief were used to filter the original features,and the obtained two sets of feature subsets are intersected to filter out the common feature sets.On this basis,the common feature subset is used as the initial feature subset of Sequential Backward Selection(SBS),and the support vector machine(SVM)is used as the classifier to construct the classification model to select the optimal combination of features.Which has the following two meanings:(1)The traditional Filter method usually arranges features according to preset indicators,and deletes features whose result are smaller than the threshold.The use of this method for feature selection involves the problem of how to set the threshold.The selection of the optimal feature subset and the performance of the final classifier are often affected by the suitability of the threshold setting.The method proposed in this paper isto use the Filter method to sort all features,and finally rely on the performance of the classifier as the evaluation basis,instead of simply using the score calculated by the Filter method as the acceptance condition.This selection method makes it possible for every feature to be selected as the optimal feature subset regardless of the single feature score calculated by the Filter method to avoid the problem of the combined feature.Because some important features have less information on their own,but the classification is idea when it combines with other features.(2)The Wrapper feature selection method relies on the learning algorithm.The method nests the performance of the classifier as an evaluation function in the running process of the algorithm.The accuracy is high and the classification effect is good,but the time complexity is high and a lot of computing resources are consumed.The method of this paper firstly uses the Filter method to filter the features in the original feature set,and then finds the optimal feature subset through the Wrapper method,which is beneficial to reduce the time consumption of the algorithm.In addition,considering that the sequence backward search method is a greedy algorithm,this algorithm can only delete features but cannot add new features,and it is easy to fall into local optimum.In the fourth chapter,this paper proposes a feature selection method based on Memeticalgorithm.The original features are first filtered using the Fisher score method;In the Wrapper phase,the features are further screened using the Memetic algorithm which dynamically adjusts the parameters through adaptive crossover and mutation probabilities,embeds the simulated annealing algorithm into the genetic algorithm according to a certain rule strategy,uses the simulated annealing algorithm to improve the method of selecting individual by genetic algorithm,optimizes the individual population and finally gets the optimal solution.This algorithm not only has the global search ability of genetic algorithm,but also accelerates the convergence speed of the algorithm through local heuristic search,and has strong convergence performance.It is more likely to obtain high-quality solutions which are beneficial to the application in actual network intrusion systems.