[Paper Review] Identifying Relevant Features of CSE-CIC-IDS2018 Dataset for the Development of an Intrusion Detection System

László Göcs, Zsolt Csaba Johanyák|arXiv (Cornell University)|Jul 21, 2023

Network Security and Intrusion DetectionComputer Science3 citations

TL;DR

This paper proposes a systematic feature selection pipeline for the CSE-CIC-IDS2018 dataset to optimize intrusion detection system (IDS) performance. By applying six feature selection methods and averaging their scores, the authors identify minimal, high-impact feature subsets for five attack types—achieving near-perfect accuracy (up to 1.00000) with as few as 7 features using Random Forest and Tree-based classifiers.

ABSTRACT

Intrusion detection systems (IDSs) are essential elements of IT systems. Their key component is a classification module that continuously evaluates some features of the network traffic and identifies possible threats. Its efficiency is greatly affected by the right selection of the features to be monitored. Therefore, the identification of a minimal set of features that are necessary to safely distinguish malicious traffic from benign traffic is indispensable in the course of the development of an IDS. This paper presents the preprocessing and feature selection workflow as well as its results in the case of the CSE-CIC-IDS2018 on AWS dataset, focusing on five attack types. To identify the relevant features, six feature selection methods were applied, and the final ranking of the features was elaborated based on their average score. Next, several subsets of the features were formed based on different ranking threshold values, and each subset was tried with five classification algorithms to determine the optimal feature set for each attack type. During the evaluation, four widely used metrics were taken into consideration.

Motivation & Objective

• To identify a minimal, relevant set of features from the CSE-CIC-IDS2018 dataset that enables high-accuracy intrusion detection.
• To evaluate the impact of different feature selection methods and ranking thresholds on classification performance.
• To determine the optimal feature subset and classifier combination for each of five attack types (FTP, SSH, WEB, XSS, SQL Injection).
• To assess whether reduced feature sets maintain or improve detection accuracy compared to full-dimensional input.
• To provide a reusable, data-driven workflow for feature selection in anomaly-based IDS development.

Proposed method

• Applied six feature selection methods—Information Gain, Chi-Square, Correlation, ReliefF, Recursive Feature Elimination, and ANOVA F-test—on preprocessed CSE-CIC-IDS2018 data.
• Normalized individual feature scores from each method and computed an average score to rank features across all techniques.
• Defined six ranking thresholds to generate multiple feature subsets, varying from 1 to 44 features per attack type.
• Trained five classifiers—Logistic Regression, Random Forest, Decision Tree, SVM, and Naive Bayes—on each feature subset using Orange software.
• Evaluated models using four metrics: accuracy, precision, recall, and F1-score on both training and test datasets.
• Selected the best-performing model and feature set per attack type based on highest F1-score and overall performance stability.

Figure 1: Dataset preprocessing workflow

Experimental results

Research questions

• RQ1 Which features from the CSE-CIC-IDS2018 dataset are most relevant for detecting specific attack types (FTP, SSH, WEB, XSS, SQL Injection)?

Key findings

• For FTP attacks, a feature set of 8 attributes selected at a ranking threshold of 0.35 achieved 100% accuracy, precision, recall, and F1-score using Random Forest.
• For SSH attacks, 7 features at threshold 0.35 yielded 99.999% accuracy with Random Forest, demonstrating near-perfect detection.
• The WEB attack required 44 features (threshold 0.35) to achieve 99.994% accuracy, with Tree-based classifiers performing best.
• For XSS attacks, 10 features at threshold 0.45 enabled 99.999% accuracy using Random Forest, outperforming other models.
• SQL Injection detection achieved 99.999% accuracy with 26 features (threshold 0.40) using a Tree classifier, with F1-score of 0.97647.
• Tree-based and Random Forest classifiers consistently outperformed others across all attack types, especially with reduced feature sets.

Figure 2: Feature selection workflow