## 5 Machine Learning and Feature Selection Enabled IDS
### FS-Enabled IDS  
Feature selection is a preprocessing optimization technique used to elect a subset of significant features by evacuating insignificant and excess features from the dataset for building an effective learning model [71]. Generally, each classifier is trained on a given dataset; hence, a dataset with a large number of features consequently requires more training and testing time, along with a considerable amount of computing resources. In addition, not all features within a dataset are necessarily relevant to attack detection for the devised classification model [72]. To address the above highlighted problems, feature selection methods are utilized before the application of ML algorithms, which helps in reducing the computation time and obtains more accurate results [73; 74]. Typically, the feature selection procedure generally consists of four steps, as shown in Figure 4. At the start, a subset generated from the original dataset is assessed by using the evaluation function, which calculates the goodness of the generated subset. Furthermore, the evaluated goodness is fed to the next phase, where stopping criteria decide whether to validate or invalidate the subset [75]. The feature selection algorithms have been classified into three categories as follows: Wrapper, Filter, and Embedded methods [76].  
The filter-based method eliminates insignificant features with minimal impact on data analysis. This approach conducts a statistical test for each attribute in the dataset, considering its relationship with the targeted attribute. Consequently, in filter criteria, all the features are scored and ranked based on certain statistical tests [77]. The features with the highest-ranking values are selected, and the low-scoring features are removed. This approach is computationally efficient and produces fewer system overheads [78]. Wrapper-based feature selection follows a greedy search approach by evaluating all possible feature combinations against the evaluating criteria [75]. The targeted attributes and possible combinations of independent variables are assessed by learning and evaluating a classifier. The wrapper approaches predict better accuracy as opposed to filter-based approaches but require more computational resources [77]. The embedded methods combine the qualities of filter and wrapper methods; consequently, such methods produce a highly accurate feature set [79]. Table 4 presents and summarizes the methods widely adopted in literature for feature selection that have been commonly adopted in the context of ML-based IDS.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Categories** & **Methods** & **Description** \\ \hline \multirow{6}{*}{Filter} & \multirow{3}{*}{Information Gain (IG)} & Quantities the reduction in entropy resulting from the transformation of a dataset. Additionally, it evaluates the IG of each variable in the context of the target variable [80]. \\  & & Performed for each attribute concerning the target and selected the features having high chi-square values. This test is usually performed for categorical attributes in the dataset [81]. \\  & & Correlation measures the linear relationship of two or more attributes which helps in identifying attributes that are supremely co-related with the target. Moreover, if more than one attributes are correlated, the approach only takes a single attribute and leaves other redundant attributes/features [82]. \\ \hline \multirow{2}{*}{Variance Threshold} & \multirow{2}{*}{Variance Threshold} & Variance Threshold is a methodology that includes all the attributes whose variance meets the baseline. By default, it eliminates all the features having zero-variance [83]. \\  & & \\ \hline \hline \end{tabular}
\end{table}
Table 4: Description of Feature Selection Methods.  
Figure 4: Feature selection procedure.