METHODOLOGY FOR COMPLEX FEATURE OPTIMIZATION IN CYBERATTACK DETECTION SYSTEMS

Abstract

This article addresses one of the most pressing challenges in modern cybersecurity - the necessity of enhancing the efficiency of intelligent Intrusion Detection Systems (IDS) amidst rapid digitalization and an increasingly complex threat landscape. The authors provide a substantive justification that traditional signature-based methods are becoming insufficient against AI-driven attacks, necessitating a transition to machine learning techniques. However, the high dimensionality of network traffic and the presence of numerous redundant, correlated, or noisy features create a "curse of dimensionality" effect. This leads to a critical increase in computational overhead, delayed real-time system response, and reduced classification accuracy due to model overfitting. The relevance of this work is underscored by the need to develop systemic data preprocessing approaches, specifically demonstrated using the benchmark NSL-KDD dataset.

The object of the study is the process of optimizing input data for cyber-attack classifiers. The author proposes and details a four-stage methodology for comprehensive feature optimization. The methodology is based on a hybrid combination of various approaches: preprocessing (cleaning, normalization, and standardization); feature selection (application of filter methods such as Pearson correlation and Mutual Information (MI), embedded methods, and wrapper methods); and feature extraction (utilizing dimensionality reduction techniques such as Principal Component Analysis (PCA) and LDA/ULDA (Linear Discriminant Analysis)), which allows for the transformation of the original space into a smaller set of uncorrelated components.

The scientific novelty of the work lies in the systemic integration of statistical filters with ensemble learning methods for fine-tuning models to the specific characteristics of network traffic. The article provides a mathematical justification for each method, specifically through Shannon entropy and the Gini index. It is demonstrated that for the NSL-KDD dataset, using only 12-15 of the most relevant features allows for maintaining classification accuracy at the level of 98–99%, significantly outperforming models trained on the full set (41 features) in terms of training and inference speed. Special attention is given to the advantages of the ULDA method in addressing multicollinearity. The authors conclude that the proposed methodology serves as a universal tool for IDS optimization, achieving a balance between accuracy, speed, and system robustness. Future research directions are identified: adapting models to imbalanced data, utilizing non-linear deep learning-based autoencoders, and investigating the resilience of selected features against adversarial attacks.