Non-Dominated Sorting Genetic Algorithm-Based Dynamic Feature Selection for Intrusion Detection System

Intrusion detection system (IDS) is a combination of software application and hardware devices that monitors the network and filters activities for malicious or unauthorized access attempts. IDS are deployed for generating large volumes of stream data, which can be challenging to identify relevant features and reduce false positives. Feature selection is a candidate solution for preserving only relevant features and filtering out non-relevant features in IDS. The feature selection is performed using multi-objective optimization based meta-heuristic searching algorithms (MOO-MHS), minimizing two objective functions: error rate and memory usage. Traditional FS has limited suitability due to the stream nature of IDS data and the occurrence of concept drift. To solve this challenge, the MOO-MHS is promising to be updated to support dynamic feature selection (DFS) for serving IDS. Therefore, this paper proposes a novel framework for DFS in IDS using MOO-MHS. The proposed framework is an Enhanced Dynamic Filter-Based Feature Selection (E-DFBFS) that enables periodic call of non-dominated sorting genetic algorithm 2 (NSGA-II) that provides a novel solution selection algorithm using two selection types, namely, mean and median. The performance of the proposed E-DFBFS framework is compared with existing state-of-the-art benchmarking algorithms considering both synthetic and real-world data, providing superiority over DFBFS in terms of accuracy and F-measure and most classification metrics.'