Abstract:

In order to eliminate redundant features, reduce the system burden of storage and computation, and improve the performance of the classifier for network intrusion detection, a method to extract network intrusion detection feature is proposed based on the Fisher score and the support vector machine （SVM）. Then, in accordance with KDD^,99 network intrusion detection dataset, the feature significance rankings for the mixed attack and four single attacks are respectively obtained by using the proposed method. By extracting important features, a SVM classifier is thus constructed. Experimental results show that, as compared with the classifier constructed based on all features, the new classifier is of approximately equivalent accuracy and dramatically low training and testing time cost.

Key words: intrusion detection system, feature extraction, Fisher score, support vector machine