HFCCW: A Novel Hybrid Filter-Clustering-Coevolutionary Wrapper Feature Selection Approach for Network Anomaly Detection

Network anomaly detection (NAD) is a crucial Artificial Intelligence (AI)-based security solution for protecting computer networks. However, analyzing high-dimensional data is a significant impediment for NAD systems. The process of Feature Selection (FS) addresses this challenge by reducing or eliminating irrelevant or redundant features. Conventional FS algorithms face the drawbacks of diminished accuracy, elevated computational costs, and the inclusion of irrelevant and redundant features. This paper presents a novel three-fold Hybrid Filter-Clustering-Coevolutionary Wrapper (HFCCW) based FS approach to overcome these issues. The proposed method integrates filter and clustering techniques in the initial phases to prevent irrelevant and redundant features from being included. The first phase involves removing irrelevant features by employing the Fisher score filter method, followed by the application of clustering based on the Minimum Spanning Tree (MST) in the second phase. The second phase aims to eliminate redundant features and effectively narrow down the search space of the coevolutionary algorithm in the third phase. The method employed in the third phase adeptly integrates the strengths of particle swarm optimization (PSO) and binary grey wolf optimization (BGWO) techniques, effectively harmonizing the exploration and exploitation trade-off in the optimization process. The incorporation of the Levy Flight (LF) concept in the final iterations of BGWOPSO enhances the search steps of GWO during the third phase. It addresses the issue of GWO being confined to local optima. This improvement is achieved by applying BLFGWOPSO in the final phase of the proposed HFCCW approach. Empirical findings on the CICIDS2017 dataset substantiate the efficacy of the proposed method in enhancing classification accuracy, selecting optimal feature subsets with fewer features, reducing computing costs and improving convergence rates. Furthermore, the proposed method achieves a favorable trade-off between accuracy and computing time when contrasted with state-of-the-art methods such as filter, metaheuristic-based wrapper, and hybrid FS approaches.