Network Attack Detection System Using Filter-based Feature Selection and SVM

Abstract

The selection of features plays a big role in improving the results of a computer network attack detection system. This research used a model of feature selection to find the best combination of network traffic features to identify network attacks while retaining power explanations. This research also used filter-based feature selection, namely Information Gain (IG) and Gain Ratio (GR). Training and testing can be carried out after sigma value of SVM parameter has been determined. From sigma value testing, we chose sigma value of 5000. After SVM training, it is found that Gain Ratio with 30 features perform best for most measurement and classes. Nevertheless, full 41 features outperform IG and GR for probe class. Also, model that integrating feature selection has possibility to converge faster. It is recommended that further analysis and examination is needed to understand features combination result. Additionally, further research is needed to determine the effectiveness of features combinations to improve model performance and to try different approaches besides the filter-based method.