Multi-Binary Classifiers Using Optimal Feature Selection for Memory-Saving Intrusion Detection Systems  

作　　者：Ye-Seul Kil Yu-Ran Jeon Sun-Jin Lee Il-Gu Lee 

机构地区：[1]Department of Future Convergence Technology Engineering,Sungshin Women’s University,Seoul,02844,Republic of Korea [2]Department of Convergence Security Engineering,Sungshin Women’s University,Seoul,02844,Republic of Korea

出　　处：《Computer Modeling in Engineering & Sciences》2024年第11期1473-1493,共21页工程与科学中的计算机建模（英文）

基　　金：supported by MOTIE under Training Industrial Security Specialist for High-Tech Industry(RS-2024-00415520);supervised by the Korea Institute for Advancement of Technology(KIAT),and by MSIT under the ICT Challenge and Advanced Network of HRD(ICAN)Program(No.IITP-2022-RS-2022-00156310);supervised by the Institute of Information&Communication Technology Planning&Evaluation(IITP)。

摘　　要：With the rise of remote work and the digital industry,advanced cyberattacks have become more diverse and complex in terms of attack types and characteristics,rendering them difficult to detect with conventional intrusion detection methods.Signature-based intrusion detection methods can be used to detect attacks;however,they cannot detect new malware.Endpoint detection and response(EDR)tools are attracting attention as a means of detecting attacks on endpoints in real-time to overcome the limitations of signature-based intrusion detection techniques.However,EDR tools are restricted by the continuous generation of unnecessary logs,resulting in poor detection performance and memory efficiency.Machine learning-based intrusion detection techniques for responding to advanced cyberattacks are memory intensive,using numerous features;they lack optimal feature selection for each attack type.To overcome these limitations,this study proposes a memory-efficient intrusion detection approach incorporating multi-binary classifiers using optimal feature selection.The proposed model detects multiple types of malicious attacks using parallel binary classifiers with optimal features for each attack type.The experimental results showed a 2.95%accuracy improvement and an 88.05%memory reduction using only six features compared to a model with 18 features.Furthermore,compared to a conventional multi-classification model with simple feature selection based on permutation importance,the accuracy improved by 11.67%and the memory usage decreased by 44.87%.The proposed scheme demonstrates that effective intrusion detection is achievable with minimal features,making it suitable for memory-limited mobile and Internet of Things devices.

关 键 词：Endpoint detection and response feature selection machine learning malware detection 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]