Source-linked AI summary
Ensemble-based Multi-Filter Feature Selection Method for DDoS Detection in Cloud Computing
Opeyemi Osanaiye, Kim-Kwang Raymond Choo2, Ali Dehghantanha, Zheng Xu, Mqhele Dlodlo
TL;DR
Cloud computing is susceptible to cyber-attacks, increasing the need for effective real-time DDoS classification. The paper presents an ensemble-based multi-filter feature selection method combining four filters, which uses 13 features and reports better classification performance with J48 than other filter methods.
Problem
Cloud computing is susceptible to cyber-attacks, increasing the need for effective real-time DDoS classification.
Method
The paper presents an ensemble-based multi-filter feature selection method that combines the outputs of four filter methods.
Results
13 features yielded better performance than other filter methods using J48.
Takeaways & Limitations
The proposed method produced the best classification accuracy and improved classification accuracy and detection performance.
Takeaways & Limitations
Future work will extend evaluation to other classification algorithms and publicly available labelled datasets.
Abstract
from arXiv · showhide
Increasing interest in the adoption of cloud computing has exposed it to cyber-attacks. One of such is distributed denial of service (DDoS) attack that targets cloud bandwidth, services and resources to make it unavailable to both the cloud providers and users. Due to the magnitude of traffic that needs to be processed, data mining and machine learning classification algorithms have been proposed to classify normal packets from an anomaly. Feature selection has also been identified as a pre-processing phase in cloud DDoS attack defence that can potentially increase classification accuracy and reduce computational complexity by identifying important features from the original dataset, during supervised learning. In this work, we propose an ensemble-based multi-filter feature selection method that combines the output of four filter methods to achieve an optimum selection. An extensive experimental evaluation of our proposed method was performed using intrusion detection benchmark dataset, NSL-KDD and decision tree classifier. The result obtained shows that our proposed method effectively reduced the number of features from 41 to 13 and has a high detection rate and classification accuracy when compared to other classification techniques.
1. Introduction
Cloud computing’s open architecture exposes its resources and services to DDoS attacks, while massive traffic makes effective classification computationally demanding. The paper addresses this challenge with ensemble feature selection intended to reduce features while maintaining or improving classification accuracy.
- Cloud computing’s open internet architecture makes its services and resources susceptible to cyber-attacks, including DDoS.
- DDoS attacks recruit vulnerable hosts to coordinate traffic against a predetermined target, denying legitimate cloud users access.
- Feature selection identifies important dataset features before classification to improve prediction accuracy and reduce computational complexity.
- Filter methods rank features using intrinsic data properties independently of the classifier, making them efficient for large datasets.
- EMFFS combines Information Gain, Gain Ratio, Chi-squared, and ReliefF outputs to select important features.
- The evaluation uses the 41-feature NSL-KDD benchmark dataset and a decision tree classifier in Weka.
2. Related Work
Prior work applies diverse filter, wrapper, embedded, hybrid, rough-set, and multi-measure approaches to remove irrelevant or redundant features and improve intrusion classification. The paper positions EMFFS as a multi-filter method that combines rankings and reduces NSL-KDD features from 41 to 13 for J4.8 classification.
- Feature selection seeks a reduced subset that enables faster and more accurate classification by discarding redundant, irrelevant, and noisy features.
- Existing approaches include filter, wrapper, embedded, hybrid, rough-set, clustering, and multi-measure methods for intrusion feature selection.
- Prior NSL-KDD-based work reports reduced attack detection time, improved classification accuracy, and improved true positive rates after feature selection.
- Reviewed methods commonly remove correlated or low-information features, while some identify features that are weak individually but strong collectively.
- EMFFS combines Information Gain, Gain Ratio, Chi-squared, and ReliefF rankings to identify common important features.
- 41 to 13 features: the study uses one-third ranked subsets from NSL-KDD and J4.8, a C4.5 decision-tree implementation, for classification.
3. Ensemble-based Multi-Filter Feature Selection Method
EMFFS is a preprocessing method that combines four filter rankings and retains features appearing frequently across their selected subsets. It uses information-, dependence-, and neighborhood-based evaluators before thresholded ensemble selection.
- EMFFS execution process: EMFFS combines the four filter outputs and selects 13 common features using a threshold on their occurrence counts.
- Information Gain: Information Gain ranks features by the entropy reduction associated with information about the class.
- Gain Ratio: Gain Ratio adjusts Information Gain’s bias toward high-diversity features using branch structure and intrinsic information.
- Chi-squared: Chi-squared scores feature–class dependence, with larger scores indicating stronger dependent relationships.
- ReliefF: ReliefF weights features by their ability to distinguish nearest hits from nearest misses, retaining weights above a user-defined threshold.
- EMFFS execution process: The workflow ranks all features, takes one-third of each ranked list, combines the selected outputs, and applies majority-based ensemble selection.
4. Classification algorithm and dataset
The section describes decision-tree classification and the NSL-KDD benchmark used to evaluate intrusion detection. It covers tree construction through information gain, dataset composition, and the experimental procedure.
- Classification algorithm: Decision trees classify records using a root node, internal nodes, branches, and leaves that represent attribute-based rules and classification decisions.The root tests the first attribute, while branches represent possible attribute values and leaves represent classification outcomes.
- Classification algorithm: The root node uses the attribute with the highest information gain, followed by recursively selected attributes with the next-highest gain.The process continues until the attributes have been considered for partitioning.
- Classification algorithm: Information gain measures the difference between information needed before and after an attribute value is determined.The section derives this quantity from class probabilities, entropy, and weighted information over partitions.
- Classification algorithm: J48, a version of C4.5, is used as the decision-tree implementation for this work.C4.5 is described as using a divide-and-conquer strategy to recursively construct a decision tree.
- Benchmark dataset: NSL-KDD contains 41 features grouped into basic, content, time-based traffic, and connection-based traffic categories.The dataset is an improved benchmark derived from KDDCUP’99 and is divided into training and testing datasets.
- Experimental procedure: The experiments use 20% of NSL-KDD train+ as the denial-of-service training set and apply 10-fold cross-validation for training and testing.The dataset labels records as attack or normal and includes four attack categories: DoS, Probe, U2R, and R2L.
5. Experimental results
The experiments apply EMFFS to NSL-KDD before J48 classification, selecting features through multiple filter rankings and majority voting. Using 13 selected features, EMFFS slightly improves classification and detection performance while reducing model-building time and feature-processing complexity.
- 5.1 Pre-processing Dataset: Features 6, 30, 33, 38, 25, and 23 occur across more than three filter methods, indicating their importance to the output class.The method searches for feature agreement despite different ranking techniques.
- 5.2 Performance measures: EMFFS shows a slight improvement in classification accuracy and detection rate compared with other filter methods.The comparisons include filter-selected subsets and the full feature set using accuracy, detection rate, and false alarm rate.
- 5.2 Performance measures: 0.42% is EMFFS's false alarm rate, compared with 0.38% for the full feature set.ReliefF produces the highest false alarm rate among the compared methods.
- 5.3 Discussion: 0.78 sec is EMFFS's model-building time, compared with 2.75 sec for the full feature set.The paper attributes the longer full-feature learning time to the number of features processed.
- 5.1 Pre-processing Dataset: EMFFS selects 13 features from 41 by combining four filter rankings with a threshold and simple majority voting.The selected features are used as inputs to the J48 decision-tree classifier.
6. Conclusion
The work addresses massive internet traffic during cloud DDoS attacks with an ensemble-based multi-filter feature selection method. Using NSL-KDD and J48, the method selected 13 features and outperformed other filter methods.
- Massive internet traffic during DDoS attacks is a central challenge for cloud network intrusion systems.
- The proposed EMFFS method combines ranked outputs from information gain, gain ratio, chi-squared, and reliefF filters.It uses one-third splits of ranked important features from each filter.
- A set threshold and simple majority vote determine the final feature set from the combined filter outputs.
- 13 features produced better performance than other filter methods using the J48 classifier on the NSL-KDD dataset.
- Future work will extend evaluation to other classification algorithms and publicly available labelled datasets.