Coarse and fine feature selection for Network Intrusion Detection Systems (IDS) in IoT networks

Abstract Network Intrusion Detection Systems (NIDSs) are important in safeguarding networks from known and unknown attacks. Many research efforts have recently been made to create NIDS systems based on Machine Learning (ML) methods, addressing a significant challenge in designing standard NIDS the lack of standardized feature sets in the dataset. Given the recent development of the Internet of Things (IoT) in wireless communication, our proposed method introduces a novel solution to enhance intrusion detection systems. This proposed solution feature selection is carried out in two stages, coarse and fine selection. In the first stage of the coarse selection process, we conduct correlation analysis to identify relationships within the feature set. The second stage employs fine selection using the Whale Optimization Algorithm (WOA) with Genetic Algorithm hybridization (CFWOAGA). The fitness of each selected feature is assessed using the K‐Nearest Neighbors (KNN) algorithm. In our proposed work we integrate WOA with hybrid GA to extend the search space and avoid local optima problems via crossover and mutation operations. These selected features are critical for detecting any intrusion, we use an ML classifier to identify whether there is an attack or normal in the network and we evaluate the performance of each classifier. We evaluate the performance of our classifier using the BoT‐IoT 2020 standard dataset while limiting the selected features to 32 for reduced computational complexity, these selected 32 features are based upon considerations of system optimization and efficiency, making a balance between computational efficiency and model performance. The experimental findings show better model accuracy compared to the WOA technique and a significant drop in the False Alarm Rate (FAR). In conclusion, our proposed CFWOA method achieved an accuracy of 98.9%, while an updated version with the genetic algorithm demonstrated further improvement at 99.5%. Notably, there was a substantial improvement in FAR with our proposed method.