CSE-92-18 - An Evaluation of Feature Selection Methodsand Their Application to Computer Security
Justin Doak · eScholarship (California Digital Library) · 1992
The growing concern over the security of computer installations has led to the recent development of numerous intrusion detection systems.All of these systems rely on features of user and system behaviour to determine the likelihood of an attack.The choice of these features is somewhat arbitrary and is based solely on the opinion of an expert.This work surveys the existing field of feature selection in an attempt to discover efficient algorithms, both search procedures and eval\]ation functions, which select effective features for intrusion detection systems.In addition, a new search algorithm, random generation plus sequential selection, is presented and compared• to existing algorithms.Experiments show that random generation plus sequential selection, backward sequential selection, and beam search are the best search procedures to use in feature selection for intrusion detection systems.The experiments also showed that error rate evaluation functions are far superior to other methods of .evaluatingfeature subsets . .A final and surprising result is that backward sequential selection, although examining only a small portion of the search space, always found small feature subsets• of high .predictiveability and is clearly the best overall search algorithm.