Automatic Dataset Labelling and Feature Selection for Intrusion Detection Systems


Correctly labelled datasets are commonly required. Three particular scenarios are highlighted, which showcase this need. When using supervised Intrusion Detection Systems (IDSs), these systems need labelled datasets to be trained. Also, the real nature of the analysed datasets must be known when evaluating the efficiency of the IDSs when detecting intrusions. Another scenario is the use of feature selection that works only if the processed datasets are labelled. In normal conditions, collecting labelled datasets from real networks is impossible. Currently, datasets are mainly labelled by implementing off-line forensic analysis, which is impractical because it does not allow real-time implementation. We have developed a novel approach to automatically generate labelled network traffic datasets using an unsupervised anomaly based IDS. The resulting labelled datasets are subsets of the original unlabelled datasets. The labelled dataset is then processed using a Genetic Algorithm (GA) based approach, which performs the task of feature selection. The GA has been implemented to automatically provide the set of metrics that generate the most appropriate intrusion detection results.


The file attached to this record is the author's final peer reviewed version. The Publisher's final version can be found by following the DOI link.


Automatic Labelling, Network Traffic Labelling, Unsupervised Anomaly IDS, Feature Selection, Genetic Algorithm


Aparicio-Navarro, F.J., Kyriakopoulos, K., Parish, D.J. (2014) Automatic Dataset Labelling and Feature Selection for Intrusion Detection Systems. In proceedings of 2014 IEEE Military Communications Conference, Baltimore, USA, October 2014.


Research Institute