A HYBRID METHOD FOR FEATURE DIMENSION REDUCTION IN INTRUSION DETECTION SYSTEMS

Abstract

The paper addresses a pressing scientific and practical challenge: optimizing the feature space of network traffic to enhance the efficiency of intelligent Intrusion Detection Systems (IDS). Under the operational conditions of high-speed heterogeneous networks and stringent computational resource constraints of critical infrastructure facilities, the high dimensionality, sparsity, and multicollinearity of modern data stacks generate the "curse of dimensionality" effect. This leads to the overfitting of classification models and significant inference delays.

To overcome these limitations, a linear hybrid feature reduction methodology, PCA+LDA, is proposed, functioning as a two-stage pipelined filter. In the first stage, Principal Component Analysis (PCA) operates in an unsupervised mode, providing denoising, eliminating linear dependencies, and performing primary data compression without losing informative variance. In the second stage, supervised Linear Discriminant Analysis (LDA) projects the feature vector onto a subspace that maximizes the geometric separability between anomaly classes and legitimate traffic based on inter-class and intra-class variance.

The validation of the methodology was carried out on the representative benchmark datasets NSL-KDD and CICIDS2017. It is mathematically proven that the hybrid approach provides extreme compression of the input feature vector (by a factor of 10 for NSL-KDD and nearly 14 for CICIDS2017), accompanied by an increase in the recognition accuracy of minority threats (U2R, R2L) and complex modern web attacks. The overall False Positive rate was reduced to record lows of ~0.45% and ~0.95%, respectively.

Due to the low computational complexity and the matrix nature of linear inference, the training time of classifiers was reduced to 4% of the baseline level. This makes the proposed approach suitable for integration into highly loaded nodes for real-time gigabit traffic filtering directly at the operating system kernel level or based on programmable network interface cards (SmartNIC).

Directions for future research have been identified, including the development of mechanisms to adapt the architecture to Concept Drift in dynamic network environments, as well as increasing model robustness against Adversarial Machine Learning attacks.