Machine Learning Optimization Using Feature Selection for Botnet and Brute Force Attacks Detection in Network Systems

Abstract

The Intrusion Detection System (IDS) plays a critical role in network systems against cyber threats, in which botnet and brute force are the most identified attacks. Anomaly-based IDS as one detection type of IDS is needed to improve its ability to identify cyber threat characteristics based on machine learning. This paper explores an optimized machine learning approach by combining feature selection techniques, namely the Low Variance Filter and the Pearson Correlation Filter. The benchmark dataset, CICIDS2017, is used to evaluate the model by the Decision Tree algorithm. The results show that the model successfully optimizes cyber threat identification by reducing the number of 83 features to 10 for botnet with 99.5% accuracy and 3s computation time and 15 for brute force with 99.8% accuracy and 4s computation time.