Robust Observation Selection for Intrusion Detection

In many applications, one has to actively select among a set of expensive observations before making an informed decision. In this paper, we describe a hybrid of a simple artificial intelligence algorithm and a method based on class separability applied to the selection of feature subsets for classification problems. The method allows an expert to discover informative features for separation of normal and attack instances. Experiments performed on the KDD Cup dataset show that explanations provided by the method reveal the nature of attacks. Application of the method for feature selection yields a major improvement of detection accuracy.