Building an Effective Intrusion Detection System by Using Hybrid Data Optimization Based on Machine Learning Algorithms

Table 5

Optimal feature subset for each class of anomalous behaviors.

Class name	Sequence number of Features	Features Number
Normal	1, 2, 3, 4, 5, 6, 8, 9, 10, 12, 13, 16, 17, 18, 19, 21, 22,24, 25, 26, 27, 30, 31, 34, 38, 40	26
Generic	1, 3, 4, 5, 6, 7, 8, 15, 16, 23, 24, 27, 28, 29, 32, 35, 38,39, 40	19
Exploits	1, 2, 3, 5, 12, 17, 18, 21, 22, 25, 27, 28, 31, 39, 42	15
Fuzzers	3, 5, 8, 9, 11, 14, 15, 16, 18, 19, 20, 21, 23, 24, 25, 27, 28, 29, 31, 33, 34, 39, 41, 42	24
Reconnaissance	2, 4, 5, 7, 10, 13, 14, 15, 19, 20, 21, 22, 24, 25, 26, 28, 31, 32, 33, 34, 39, 42	22
DoS	3, 4, 5, 7, 9, 10, 12, 16, 17, 20, 21, 24, 25, 27, 29, 30, 31, 32, 35, 37, 38, 42	22
Analysis	4, 5, 7, 10, 13, 15, 19, 21, 22, 23, 24, 28, 31, 34, 38, 41, 42	17
Backdoor	7, 8, 9, 10, 12, 13, 17, 19, 20, 22, 24, 25, 26, 27, 28, 29, 30, 34, 35, 38	20
Shellcode	3, 4, 5, 6, 7, 8, 11, 14, 17, 18, 20, 22, 26, 27, 28, 30, 31, 33, 34, 36, 37, 38, 40, 42	24
Worms	1, 3, 5, 7, 10, 11, 12, 19, 22, 25, 33, 37, 41	13