Research Area: Metaheuristic Computing
This study relies on using a Moth–Flame Optimization (MFO) method as a search algorithm and a Decision Tree (DT) as an evaluation algorithm to generate an efficient feature subset for intrusion detection systems (IDS). The target is to find a feature subset using the minimum number of traffic network features that later obtains the maximum performance by the machine algorithms used in the classification task. This depends on enhancing the MFO by adopting new operators besides the embedded spiral operator to balance the exploration and exploitation alleviating the local minima problem. The main contribution of this work is the adoption of the cosine similarity measure to binarize the continuous MFO into a binary problem. Cosine similarity overcomes the limitations of the commonly used sigmoid function that depends on using a threshold value for conversion. However, cosine similarity computes the similarity ratio between the current solution and the optimal solution. The augmented MFO wrapper framework is applied as an IDS to detect anomalous traffic in the network. The proposed method is compared against several well-known state-of-the-art algorithms on three network datasets (KDDCUPP9, NSL-KDD, and UNSW-NB15), using IDSACC, IDSTPR, IDSFPR, IDSF-score, and convergence evaluation measures to assess the performance of the proposed method. The experimental results show the superiority of the proposed cosine similarity method compared to other algorithms with an accuracy of 97.8%, F-score of 99%, TPR of 99.6%, and FPR of 8.1% using only five selected features from the KDDCUPP99 dataset. It achieved the accuracy of 89.7%, TPR of 89.1%, FPR of 2.9%, when four selected features from the NSL-KDD dataset are used. And finally, it achieved an accuracy of 92.4%, TPR of 92.3%, FPR of 3%, and F-score 94.2% when the UNSW-NB15 dataset is used.
Keywords:
Moth–Flame Optimization
traffic network
classification task
sigmoid function
wrapper framework
convergence evaluation
KDDCUPP99 dataset
Author(s) Name: Moutaz Alazab, Ruba Abu Khurma, Albara Awajan, David Camacho
Journal name: Expert Systems with Applications
Conferrence name:
Publisher name: Elsevier
DOI: 10.1016/j.eswa.2022.118439
Volume Information: Volume 210
