Effects of feature selection and normalization on network intrusion detection

The rapid rise of cyberattacks and the gradual failure of traditional defense systems and approaches led to using artificial intelligence (AI) techniques (such as machine learning (ML) and deep learning (DL)) to build more efficient and reliable intrusion detection systems (IDSs). However, the advent of larger IDS datasets has negatively impacted the performance and computational complexity of AI-based IDSs. Many researchers used data preprocessing techniques such as feature selection and normalization to overcome such issues. While most of these researchers reported the success of these preprocessing techniques on a shallow level, very few studies have been performed on their effects on a wider scale. Furthermore, the performance of an IDS model is subject to not only the utilized preprocessing techniques but also the dataset and the ML/DL algorithm used, which most of the existing studies give little emphasis on. Thus, this study provides an in-depth analysis of feature selection and normalization effects on IDS models built using three IDS datasets: NSL-KDD, UNSW-NB15, and CSE-CIC-IDS2018, and various AI algorithms. A wrapper-based approach, which tends to give superior performance, and min-max normalization methods were used for feature selection and normalization respectively. Numerous IDS models were implemented using the full and feature-selected copies of the datasets with and without normalization. The models were evaluated using popular evaluation metrics in IDS modeling, intra- and inter-model comparisons were performed between models and with state-of-the-art works. Random forest (RF) models performed better on NSL-KDD and UNSW-NB15 datasets with accuracies of 99.86% and 96.01% respectively, whereas ANN achieved the best accuracy of 95.43% on the CSE-CIC-IDS2018 dataset. The RF models also achieved an excellent performance compared to recent works. The results show that normalization and feature selection positively affect IDS modeling. Furthermore, while feature selection benefits simpler algorithms (such as RF), normalization is more useful for complex algorithms like ANNs and DNNs, and algorithms such as NB are unsuitable for IDS modeling. The study also found that the UNSW-NB15 and CSE-CIC-IDS2018 datasets are more complex and more suitable for building and evaluating modern-day IDS than the NSL-KDD dataset. Our findings suggest that prioritizing robust algorithms like RF, alongside complex models such as ANN and DNN, can significantly enhance IDS performance. These insights provide valuable guidance for managers to develop more effective security measures by focusing on high detection rates and low false alert rates. • Research highlight 1 - We underscored the effectiveness of normalization and feature selection in improving Intrusion Detection System (IDS) model performance and computational time, highlighting their differential impact on various AI algorithms. • Research highlight 2 - The CSE-CIC-IDS2018 and UNSW-NB15 datasets are identified as more complex and suitable for modern-day IDS development and evaluation compared to the outdated NSL-KDD dataset, thus providing a more realistic and challenging benchmark for IDS research. • Research highlight 3 - While feature selection significantly benefits simpler algorithms like RF, normalization proves more effective for complex models such as ANNs and DNNs. Algorithms like NB are found unsuitable for IDS modeling. Notably, neural network-based algorithms exhibit superior performance without explicit feature selection, highlighting their capacity to handle high-dimensional and complex data. • Research highlight 4 - Our findings provide actionable insights for managers to improve the efficiency and effectiveness of their security measures. By prioritizing robust algorithms like RF, alongside complex models such as ANN and DNN, and focusing on high detection rates and low false alert rates, managers can develop more effective IDS strategies.