NOVEL DIFFERENTIAL EVOLUTION FOR FEATURE SELECTION IN ANOMALY-BASED INTRUSION DETECTION (ASEAN Engineering Journal, 2025)
In recent years many organizations and end users suffer from cyber-attacks or intrusions also known as zero-day attacks that aim for damaging resources or theft of data. A well-known tool for detecting such intrusions is anomaly-based Intrusion Detection System (IDS). IDS have integrated Evolutionary Computation (EC) algorithms as dimensionality reduction method to enhance the detection performance. A major limitation in anomaly-based IDS is the high rate of false alarms due to several reasons most importantly is the high volume of training and testing datasets. These high dimensionality datasets could contain irrelevant, duplicate, and redundant features that cause misclassifications and increase the false alarm rate. In this research a new variant of Differential Evolution (DE) algorithm called Differential Evolution – Convergence Extension (DE-CE) is proposed as part of the anomaly-based IDS for dimensionality reduction and feature selection. The new variant of DE adopts a new mutation strategy that ensures the continuously generating new solutions for the current population, thus ensures selecting the most relevant features from the dataset. The well-known NSL-KDD dataset is adopted for training and testing the proposed anomaly-based IDS. Evaluation is performed against previously proposed DE algorithms with different mutation strategies and PSO in terms of number of selected features, Accuracy, False Positive rate (FPR), recall, and precision for five different classifiers. The proposed DE-CE outperformed the classical DE and PSO algorithms in all performance evaluation metrics, where it achieved the highest accuracy of 99.4744% and lowest FPR of 0.3198%.