A cascaded feature selection approach in network intrusion detection

Network intrusion detection research work that employed KDDCup 99 dataset often encounters challenges in creating classifiers that could handle unequal distributed attack categories. In such cases, classifier could not effectively learn the characteristics of rare categories, which will lead to a poor detection rate of rare categories. The efficiency of intrusion detection is mainly determined by the dimension of data features. According to the feature optimization selection problems of the rare attack categories detection, this paper proposes using the cascaded SVM classifiers to classify the non-rare attack categories and using BN classifiers to classify rare attack categories, combining with cascaded GFR feature selection method (CGFR). It selects feature subset for the rare attack categories and non rare attack categories respectively. The experimental results show that the CGFR method proposed in this paper can increase the detection rate of U2R and R2L to 89.4% and 49.2% respectively.