Enhancing Intrusion Detection System Efficiency Using Feature Selection and K-Means Clustering

Abstract

Intrusion Detection Systems (IDSs) also help protect the computer systems from intruders and their attacks. With the growing amount of traffic in networks, dealing with high-dimensional data has become one of the most challenging tasks for intrusion detection models. The KDD Cup 1999 dataset, the normal benchmark for evaluation of IDS technique, contains 41 network traffic features and among these some of the features during clustering may produce redundant or less useful information in forming the clusters. In this work, a novel feature selection-based framework is proposed to enhance the efficiency of detection system in the elimination of redundant/distracting features prior to the execution of K-Means clustering algorithm. Proposed method concentrates on low complexity representation of the data within the relevant subspace where normal and anomalous network traffic patterns are now linearly separable. The methodology consists of a set of procedures such as data pre-processing, feature selection, normalization, K-Means clustering along with performance evaluation based on a set of widely used clustering and classification measures. It is anticipated that the proposed scheme could achieve better running time and cluster quality and would make the IDS process easier and simpler without dramatically degrading the detection performance. This work presents a systematic approach to advance unsupervised intrusion detection through feature selection techniques on KDD Cup 1999 dataset.