SPA-IDS: An intelligent intrusion detection system based on vertical mode decomposition and iterative feature selection in computer networks

Abstract

Ensuring the security of critical infrastructures and information systems has always been a challenging problem. Intrusion Detection Systems (IDS) have become an indispensable element in ensuring the security of network structures and information systems. it is important to increase the intrusion detection performance of IDS sys-tems. Although a lot of work has been done to improve IDS systems, there are still many shortcomings. In this study, a new Switch port anomaly based IDS (SPA-IDS) dataset is proposed for IDS systems. The data is taken over switch ports with normal internet traffic. This research presents a new automated intrusion classification model using the collected signals. These signals acquired from layer 2. The presented automated classification model consists of feature generation using vertical mode decomposition (VMD) and statistics, iterative feature selection and classification phases. These phases are given as follows. (i) VMD is applied to the acquired signals and five VMD coefficients are obtained. 15 statistical moments are applied to signal and the calculated VMD coefficients. (ii) Iterative feature selection is applied to extracted features and the most valuable features are selected. (iii) The chosen features are classified using decision tree (DT), bagged tree (BT), support vector ma-chine (SVM) and k nearest neighbor (KNN) machine learning methods with ten-fold cross validation. The pre-sented VMD and iterative feature selection based model attained 87.25%, 95.98%, 96.51% and 97.74% accuracies by employing KNN, SVM, DT and BT classifiers consecutively. After the attack categorization process in the second phase of the study, the same classifiers success rates reached 96.65%, 98.52%, 98.39% and 99.11%, respectively. The calculated/obtained accuracies obviously denotes the success of the presented VMD and iter-ative feature selection based intrusion detection system. Owing to the method presented in this study, we propose an effective and fast IDS approach by analyzing the packets received at layer-2 in order to prevent attacks from the network.