An algorithm application in intrusion forensics based on improved information gain

As a kind of feature selection algorithm applied widely in intrusion forensics, information gain could solve the problem of high-dimension and magnanimous, but it neglects correlation between features, which could lead to the redundancy of features, and affect the speed and accuracy of intrusion forensics. So an improved information gain algorithm based on feature redundancy was proposed. In the improved algorithm, the irrelevant and redundant features were removed through adding the judgments of redundancy between features, which effectively simplified feature subset. The classical KDD CUP 99 dataset is used in the experiments and the results show that the new algorithm can effectively select features, ensure detection accuracy and improve processing speed.