Research on the dependence of software quality for intrusion detection on feature selection methods in machine learning models

Abstract

The rapid increase in the complexity of cyberattacks and the growing volume of network traffic impose higher requirements on intrusion detection systems (IDS) in terms of detection accuracy, performance, and scalability. Machine learning methods play a key role in the development of modern IDS, and their effectiveness largely depends on the quality of feature selection. However, most existing studies focus on improving individual classification metrics, while the comprehensive evaluation of IDS software quality index, including resource costs associated with feature selection such as training time, inference speed, and scalability, remains insufficiently addressed.

This paper analyzes the role of machine learning and feature selection methods in intrusion detection tasks and considers the requirements of the ISO/IEC 25010 standard for software quality. Based on this, a system of quality indicators for intrusion detection systems is developed, and an integrated quality index is proposed that combines both functional and non-functional characteristics of the model.

A software tool was developed to automate the full cycle of experiments comparing different feature selection methods and machine learning models based on open network traffic datasets, with subsequent calculation of the integral quality indicator and visualization of the results.

The results demonstrate that the choice of feature selection method and the reduction of the feature space have a significant impact on the performance and scalability of intrusion detection systems, emphasizing the importance of considering this factor in a comprehensive evaluation of the modern IDS quality index.