In today’s rapidly emerging computing environment, cloud computing has become a significant trend for the delivery of IT business services, and representes a potential technology resource choice that offers cost effective and scalable processing. However, Distributed Denial of Service (DDoS) attacks continually target cloud services and resource availability, rendering the cloud unavailable to the detriment of both cloud providers and users. In previous research, feature selection, has revealed its importance in the recognition of irrelevant and redundant features, which increases detection rates and decreases processing speeds toward the evaluation of intrusive patterns, while reducing computational complexity. In this work we propose a Hybrid Filter-Wrapper Feature Selection HFWFS method for DDoS detection, which takes advantage of both filter and wrapper methods, to identify the most irrelevant and redundant features in order to form a reduced input subset. Subsequently, it applies a wrapper method to achieve the optimal selection of features. To evaluate the performance of our proposed model, we used two datasets (NSL-KDD and UNSW-NB15) and a Random Tree classifier. The results indicated that the proposed model may reduce the number of features from more than 40 to nine, while maintaining high detection accuracy, in contrast to well-known feature selection methods.
TesfahunA. and BhaskariD., Intrusion Detection using Random Forests Classifier with SMOTE and Feature Reduction, In Proceedings of the International Conference on Cloud & Ubiquitous Computing & Emerging Technologies (CUBE), IEEE, Pune, 2013, pp. 127–132.
2.
AbrahamA.JainR.ThomasJ. and HanS.Y., D-scids: Distributed soft computing intrusion detection system, Journal of Network and Computer Applications30(1) (2007), 81–98.
3.
AfzalA. and TorkarR., Towards benchmarking feature subset selection methods for software fault prediction,Computational Intelligence and Quantitative Software Engineering, Springer International Publishing, 2016, pp. 33–58.
4.
MohamedA.GrundyJ. and MüllerI., An analysis of the cloud computing security problem, arXiv preprint arXiv:1609.01107 2016.
5.
MohammedA. et al., Building an intrusion detection system using a filter-based feature selection algorithm, IEEE Transactions on Computers65(10) (2016), 2986–2998.
6.
FatemehA. et al., Mutual information-based feature selection for intrusion detection systems, Journal of Network and Computer Applications34(4) (2011), 1184–1199.
7.
AgarwalB. and MittalN., Optimal feature selection for sentiment analysis, Proceedings of 14th International Conference on Computational Linguistics and Intelligent Text Processing CICLing, Springer, Samos, Greece, 2013, pp. 13–24.
8.
ChangV.Yen-HungK. and MuthuR., Cloud computing adoption framework: A security framework for business clouds, Future Generation Computer Systems57 (2016), 24–41.
9.
QuickD. and ChooK.-K.R., Impacts of increasing volume of digital forensic data: a survey and future research challenges, Digit Investig11(4) (2014), 273–294.
10.
Data mining software in Java. http://www.cs.waikato.ac.nz/ml/weka/Last accessed 7 May 2017.
11.
ZhangF. and WangD., An effective feature selection approach for network intrusion detection, In Eighth IEEE International Conference on Networking, Architecture and Storage (NAS), 2013, pp. 307–311.
12.
YiG. et al., Multi-agent intrusion detection system using feature selection approach, Intelligent Information Hiding and Multimedia Signal Processing (IIH-MSP), 2014 Tenth International Conference on, IEEE, 2014.
13.
EidH.HassanienA.KimT. and BanerjeeS., Linear correlation-based feature selection for network intrusion detection model, In Proceedings of the 1st International Conference on Advances in Security of Information and Communication Networks (SecNet). Springer, Cairo, 2013, pp. 240–248.
14.
IbrahimH.BadrS. and ShaheenM., Adaptive layered approach using machine learning techniques with gain ratio for intrusion detection systems,Int J Comput Appl56(7) (2012), 10–16.
15.
Hui-HuangH.HsiehC.-W. and LuM.-D., Hybrid feature selection by combining filters and wrappers, Expert Systems with Applications38(7) (2011), 8144–8150.
16.
IdhammadM.AfdelK. and BelouchM., DoS Detection Method based on Artificial Neural Networks, International Journal of Advanced Computer Science and Applications,2017.
17.
PengJ.ChooK.-K.R. and AshmanH., Bit-level n-gram based forensic authorship analysis on social media: Identifying individuals from linguistic profiles, J Netw Comput Appl, Elsevier, 2016 in press.
18.
YuJ.KangH.ParkD.BangH. and KangD., An in-depth analysis on traffic flooding attacks detection and system using data mining techniques, J Syst Architect59(10) (2013), 1005–1012.
19.
XuJ. and SheltonC.R., Intrusion detection using continuous time bayesian networks, J Artif Intell Res, 2010.
20.
GuptaK.NathB. and KotagiriR., Layered approach using conditional random fields for intrusion detection, IEEE Transactions on Dependable and Secure Computing7(1) (2010), 35.
21.
KrämerL.KruppJ.MakitaD.NishizoeT.KoideT.YoshiokaK. and RossowC., AmpPot: monitoring and defending against amplification DDoS attacks, In Proceedings of 18th International Symposium on Research in Attacks Intrusion and Defenses (RAID), Springer, Kyoto, 2015.
22.
KocL.MazzuchiT. and SarkaniS., A network intrusion detection system based on a Hidden Naïve Bayes multiclass classifier, Expert Syst Appl39(18) (2012), 13492–13500.
23.
ZhaoL.ChenL.RanjanR.ChooK.-K.R. and HeJ., Geographical information system parallelization for spatial big data processing: A review, Cluster Comput, Springer, 2015 in press.
24.
YuL. and LiuH., Feature selection for high-dimensional data: A fast correlation-based filter solution, In Proceedings of the Twentieth International Conference on Machine Learning (ICML-2003). Springer, Washington DC, 2003, pp. 856–863.
25.
FiccoM. and RakM., Stealthy denial of service strategy in cloud computing, IEEE Trans Cloud Comput3(1) (2015), 80–94.
26.
NourM. and SlayJ., The evaluation of Network Anomaly Detection Systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set, Information Security Journal: A Global Perspective25(1-3) (2016), 18–31.
27.
NourM. and SlayJ., UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set), Military Communications and Information Systems Conference (MilCIS), 2015. IEEE, 2015.
28.
AcharyaN. and SinghS., An IWD-based feature selection method for intrusion detection system, Soft Computing (2017), 1–10.
29.
NissimN.MoskovitchR.RokachL. and EloviciY., Detecting unknown computer worm activity via support vector machines and active learning, Pattern Anal Appl15(4) (2012), 459–475.
30.
OsanaiyeO.ChooK.-K.R. and DlodloM., Distributed denial of service (DDoS) resilience in cloud: review and conceptual cloud DDoS mitigation framework, J Netw Comput Appl67 (2016), 147–65.
31.
OsanaiyeO.CaiH.ChooK.K.DehghantanhaA.XuZ. and DlodloM., Ensemble-based multi-filter feature selection method for DDoS detection in cloud computing, EURASIP Journal on Wireless Communications and Networking, No. 1, 2016, pp. 1–10.
32.
OpeyemiO. et al., Ensemble-based multi-filter feature selection method for DDoS detection in cloud computing, EURASIP Journal on Wireless Communications and Networking, 2016.
33.
BermejoP.de la OssaL.GámezJ. and PuertaJ., Fast wrapper feature subset selection in high-dimensional datasets by means of filter re-ranking, KnowlBased Syst25(1) (2012), 35–44.
34.
BhattacharyaS. and SelvakumarS., Multi-measure multi-weight ranking approach for the identification of the network features for the detection of DoS and Probe attacks, Compt J (2015), 1–21.
35.
ChebroluS.AbrahamA. and ThomasJ.P., Feature deduction and ensemble design of intrusion detection systems, Computers & Security24(4) (2005), 295–307.
36.
MukkamalaS. and SungA.H., Significant feature selection using computational intelligent techniques for intrusion detection, Advanced Methods for Knowledge Discovery from Complex Data, Springer, 2005, pp. 285–306.
37.
LinS.YingK.LeeC. and LeeZ., An intelligent algorithm with feature selection and decision rules applied to anomaly intrusion detection,Appl Soft Comput12(10) (2012), 3285-3290.
SindhuS.GeethaS.KannanA., Decision tree based light weight intrusion detection using a wrapper approach,Expert Syst Appl39(1) (2012), 129-141.
40.
ZargarS.JoshiJ.TipperD., A survey of defense mechanisms against distributed denial of service (DDoS) flooding attacks,IEEE Commun Surv, Tutorials 2013.
41.
MahbodT. et al., A detailed analysis of the KDD CUP 99 data set, Computational Intelligence for Security and Defense Applications, 2009. CISDA 2009. IEEE Symposium on. IEEE, 2009.
42.
CoverT.M. and ThomasJ.A., Elements of information theory, John Wiley & Sons, 2012.
43.
PengT.LeckieC. and RamamohanaraoK., Survey of network-based defense mechanisms countering the dos and DDoS problems, ACM omput Surv (1) 2007.
44.
Bolon-CanedoV.Sanchez-MaronoN. and Alonso-BetanzosA., Feature selection and classification in multiple class datasets: an application to KDD Cup 99 dataset, Expert Syst Appl38(5) (2011), 5947–5957.
45.
WangB. et al., DDoS attack protection in the era of cloud computing and software-defined networking, Computer Networks81 (2015), 308–319.
46.
HuangW.ZhangJ.SunH. et al., An Anomaly Detection Method Based on Normalized Mutual Information Feature Selection and Quantum Wavelet Neural Network, Wireless Personal Communications96(2) (2017), 2693–2713.
47.
WangW. and GombaultS., Efficient detection of DDoS attacks with important attributes, In Proceedings of the 3rd International conference on Risks and Security of Internet and Systems (CRiSIS’08), IEEE, Tozeur, 2008, pp. 61–67.
48.
WangW.HeY.LiuJ. and GombaultS., Constructing important features from massive network traffic for lightweight intrusion detection, IET Inform Secur9(6) (2015), 374–379.
49.
ChenY.LiY.ChengX. and GuoL., Proceedings of the 2nd SKLOIS Conference Information Security and Cryptology (INSCRYPT), in Survey and taxonomy of feature selection algorithms in intrusion detection system (Springer), Beijing, 2006, pp. 153–167.
50.
ChenY.AbrahamA. and YangB., Feature selection and classification flexible neural tree, Neurocomputing70(1) (2006), 305–313.
51.
LiY.XiaJ.ZhangS.YanJ.AiX. and DaiK., An efficient intrusion detection system based on support vector machines and gradually feature removal method, Expert Syst Appl39(1) (2012), 424–430.
52.
YangJ. et al., A new feature selection based on comprehensive measurement both in inter-category and intra-category for text categorization, Information Processing & Management48(4) (2012), 741–754.
53.
BaigZ.SaitS. and ShaheenA., GMDH-based networks for intelligent intrusion detection, Eng Appl Artif Intel26(7) (2013), 1731–1740.
54.
XuZ.ZhangH.SugumaranV.ChooK.-K.R.MeiL. and ZhuY., Participatory sensing-based semantic and spatial analysis of urban emergency events using mobile social media, EURASIP J Wirel Commun Netw1 (2016), 1–9.
55.
XuZ.LiuY.YenN.MeiL.LuoX.WeiX. and HuC., Crowdsourcing based description of urban emergency events using social media big data, IEEE Trans Cloud Comput, 2016.
