A Survey of Feature Selection Techniques in Intrusion Detection System: A Soft Computing Perspective

In the process of detecting different kinds of attacks in anomaly-based intrusion detection system (IDS), both normal and attack data are profiled with the help of selected attributes. Various types of attributes are collected to create the attack and normal traffic patterns. Some of the attributes are derived from protocol header fields, and some of them represent continuous information profiled over a period. "Curse of Dimensionality" is one of the major issues in IDS. The computational complexity of the model generation and classification time of IDS is directly proportional to the number of attributes of the profile. In a typical IDS preprocessing stage, more significant features among the available features are selected. This paper presents a brief taxonomy of several feature selection methods with emphasis on soft computing techniques, viz., rough sets, fuzzy rough sets, and ant colony optimization.