Feature Selection Using Information Gain for Improved Structural-Based Alert Correlation

PLoS One. 2016 Nov 28;11(11):e0166017. doi: 10.1371/journal.pone.0166017. eCollection 2016.

Abstract

Grouping and clustering alerts for intrusion detection based on the similarity of features is referred to as structurally base alert correlation and can discover a list of attack steps. Previous researchers selected different features and data sources manually based on their knowledge and experience, which lead to the less accurate identification of attack steps and inconsistent performance of clustering accuracy. Furthermore, the existing alert correlation systems deal with a huge amount of data that contains null values, incomplete information, and irrelevant features causing the analysis of the alerts to be tedious, time-consuming and error-prone. Therefore, this paper focuses on selecting accurate and significant features of alerts that are appropriate to represent the attack steps, thus, enhancing the structural-based alert correlation model. A two-tier feature selection method is proposed to obtain the significant features. The first tier aims at ranking the subset of features based on high information gain entropy in decreasing order. The‏ second tier extends additional features with a better discriminative ability than the initially ranked features. Performance analysis results show the significance of the selected features in terms of the clustering accuracy using 2000 DARPA intrusion detection scenario-specific dataset.

MeSH terms

  • Algorithms*
  • Cluster Analysis
  • Computer Security*
  • Information Storage and Retrieval
  • Software

Grants and funding

We would like to thank Ministry of Higher Education (MoHE) and Universiti Teknologi Malaysia for funding this work under Potential Academic Staff research grant with reference number PY/2014/02899. The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript.