# Unsupervised Feature Selection for Outlier Detection on Streaming Data to Enhance Network Security
## 3 Requirements Engineering and Comparison with Related Work
### Feature Selection for Outlier Detection  
FS for IDS must be able to determine the most relevant features of incoming data, e.g., network traffic, to minimize the cardinality of the set of selected features, which affects their effectiveness without dropping features indicating abnormal behavior. A review on FS algorithms for A-NIDS can be found in [30] dividing them into bio- and non-bio-inspired ones. However, the authors do not focus on the supervision perspective, thus, their reviewed work only leverages different supervised FS methods. None of the reviewed approaches seem to address the requirements defined in Section 3.1. This is discussed by the authors since most of the methods are based on the wrapper nature or on a combination of FS algorithms, which increases the computation and time complexity. A lot of FS methods [31; 32; 33; 34; 35] within the context of OD, even recent ones [36; 37; 38], are operating supervised. Those approaches are mainly performing multiple evaluations due to their wrapper nature on a dedicated dataset typically, KDD'99 or NSL-KDD, to test different feature subsets using a certain classifier. Within their setting, they achieve the best subset of features, resulting in an optimal classification performance. However, facing highly dynamic networks with large volumes of data and high velocity, an analysis is necessary, which is beyond the aforementioned approaches. Some of the authors even state that their approaches take a lot of time to train [35] or to use other classifiers and verify them under more realistic environments [33]. However, with the improvements mentioned in the outlook of [35], it is the only work in the field of FS for OD considering support for online processing even though still being of supervised nature. For the rest of this section, we set our focus on unsupervised approaches since those are more meaningful for real-world applications of OD methods. A limited amount of papers are dealing with FS approaches for the purpose of OD in an unsupervised nature. The algorithm in [39], denoted in this article as FS-CVI, uses a genetic algorithm to optimize a cluster validity index. This is a measure of how well a clustering algorithm manages to identify and assign clusters in a dataset, over a search space consisting of feature subsets. Classification based on the proposed subsets from the genetic algorithm is performed in such a way that clusters are being built which are representing legitimate traffic and others more prevalent pertaining to intrusions. An unsupervised backward elimination FS algorithm based on the Hilbert-Schmidt independence criterion, named BAHSIC-AD, is proposed in [40]. The authors compare their approach with a recent Spectral Ranking for Anomalies (SRA) algorithm and show that a combination of SRA and BAHSIC-AD is able to detect point, collective, and contextual anomalies. Their evaluation is performed on real-world datasets taken from various application domains. However, the field of cybersecurity with intrusion detection is not covered. With a focus on categorical features, ref [41] proposed a method that we denote as MI-FS based on \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Work** & **\#1** & **\#2** & **\#3** & **\#4** & **\#5** & **\#6** & **\#7** & **\#8** \\ \hline OSFSMI [17] & ✓ & ✓ & \(-\) & ✗ & \(\varnothing\) & ✓ & \(++\) & ✓ \\ UFSSP [18] & ✓ & ✓ & \(++\) & ✗ & ✗ & ✓ & \(-\) & ✗ \\ DOFS [19] & ✓ & ✓ & \(-\) & ✗ & ✗ & ✓ & \(+\) & ✗ \\ OFS [23] & ✗ & ✓ & \(++\) & ✗ & ✓ & ✓ & \(++\) & ✗ \\ MC-NN [24] & ✓ & ✓ & \(\varnothing\) & ✗ & ✓ & ✓ & \(++\) & ✓ \\ EaSU [25] & ✗ & ✓ & \(++\) & ✗ & ✓ & ✓ & \(+\) & ✓ \\ OMVFS [27] & ✓ & ✓ & \(++\) & ✗ & ✗ & ✓ & \(++\) & ✓ \\ FSDS [28] & ✓ & ✓ & \(++\) & ✗ & ✓ & ✓ & \(++\) & ✓ \\ \hline \hline \end{tabular}
\end{table}