The Influence of Salp Swarm Algorithm-Based Feature Selection on Network Anomaly Intrusion Detection

Network security plays a critical role in our lives because of the threats and attacks to which we are exposed, which are increasing daily; these attacks result in a need to develop various protection methods and techniques. Network intrusion detection systems (NIDSs) are a way to detect malicious network attacks. Many researchers have focused on developing NIDSs based on machine learning (ML) approaches to detect diverse attack variants. ML approaches can automatically discover the essential differences between normal and abnormal data by analysing the features of a large dataset. For this purpose, many features are typically extracted without discrimination, increasing the computational complexity. Then, by applying a feature selection method, a subset of features is selected from the whole feature set with the aim of improving the performance of ML-based detection methods. The salp swarm algorithm (SSA) is a nature-inspired optimization algorithm that has demonstrated efficiency in minimizing the processing challenges faced in performing optimization for feature selection problems. This research investigates the impact of the SSA on improving ML-based network anomaly detection using various ML classifiers, including the extreme gradient boosting (XGBoost) and Naïve Bayes (NB) algorithms. Experiments were conducted on standard datasets for comparison. Specifically, two datasets explicitly focused on network intrusion attacks were used: UNSW-NB15 and NSL-KDD. The experimental results show that the proposed method is more effective in improving the performance of anomaly NIDSs in terms of the F-measure, recall, detection rate, and false alarm rate on both datasets, outperforming state-of-the-art techniques recently proposed in the literature.