Exploring the stability of feature selection for imbalanced intrusion detection data

The class imbalance problem is of great importance to network intrusion detection data. Previous studies on feature selection always evaluate the performance of feature selection process according to the model performance and the size of selected feature subset, which neglect the stability of feature selection. We investigate the problem of the stability of feature selection and study in detail the properties of two state-of-the-art feature selection method, i.e. support vector machine recursive feature elimination (SVM-RFE) and random forest variable importance measures (RF-VIM) on the imbalanced intrusion detection data. Experimental results on KDD Cup 99 network intrusion data show the influence of imbalance rate on the stability of the algorithms, and demonstrate that stability is an important evaluation indicator of algorithm in practical applications of intrusion detection.