# Enhancing Machine Learning Prediction in Cybersecurity Using Dynamic Feature Selector
## 5 Experimental Analysis
### Meta-Learner  
Meta-learning, which is inspired by cognitive psychology is a proven effective method for machine learning techniques to excel at mastering predictive skills [55; 56]. When a meta-learner is applied to the machine learning algorithm, it uses prior experience to change certain aspects of the algorithm. In simple terms, a meta-learner can be defined as a way that enables learning algorithms to learn themselves [57]. Machine learning algorithms are getting better over time, but still lack the versatility. This can be achieved by intelligent amalgamation of meta-learning along with similar techniques such as reinforcement learning, transfer learning and active learning [58; 59]. Researchers also focus on using meta-learning for hyper-parameter tuning, neural network optimization and specifying best network architecture. In this research, we have used the meta-learner to optimize hyper-parameters through a bagging ensemble process [60]. The algorithm attempts to find the best features after carefully investigating the performance and robustness of the predictive model. This dynamic feature selector takes the output of ANOVA F-test, Pearson Correlation, Gradient Boosting, Information Gain and Wrapper Method to find out the best feature subset. What makes it dynamic is the nature of the meta-learner in this approach. The meta-learner processes feature that have been deemed as important by various feature selection processes. It then selects a subset of these best features and trains several machine learning models. The bagging ensemble process uses five different algorithms as mentioned  
\begin{table}
\begin{tabular}{c c c c} \hline \hline \multicolumn{2}{c}{**NSL KDD Features**} & \multicolumn{2}{c}{**UNSW NB-15 Features**} \\ \hline duration & src\_bytes & dpkts & dur \\ \hline wrong\_fragment & num\_failed\_logins & rate &bytes \\ \hline logged\_in & root\_shell & dload & dttl \\ \hline count & dst\_host\_count & swin & sloss \\ \hline dst\_host\_srv\_count & dst\_host\_same\_srv\_rate & ackdat & tcprt \\ \hline dst\_host\_diff\_srv\_rate & dst\_host\_same\_src\_port\_rate & response\_body\_len & trans\_depth \\ \hline dst\_host\_srv\_diff\_host\_rate & dst\_host\_server\_rate & ct\_state\_tl & ct\_srv\_src \\ \hline dst\_host\_error\_rate & diffic & ct\_src\_dport\_ltm & ct\_dst\_ltm \\ \hline Protocol\_type\_icmp & Protocol\_type\_tcp & ct\_ftp\_cmd & ct\_dst\_sport\_ltm \\ \hline service\_IRC & service\_echo & ct\_src\_ltm & ct\_flw\_http\_mthd \\ \hline service\_eco\_i & service\_efs & proto\_any & proto\_3 pc \\ \hline service\_exec & service\_ftp & proto\_ax\_25 & proto\_aris \\ \hline service\_ftp\_data & service\_gopher & proto\_ddp & proto\_br-sat-mon \\ \hline service\_http & service\_http\_2784 & proto\_i\_nlsp & proto\_fc \\ \hline service\_http\_8001 & service\_ldap & proto\_idrp & proto\_idpr \\ \hline service\_login & service\_netbios\_ns & proto\_igp & proto\_ifmp \\ \hline service\_nnsp & service\_ntp\_u & proto\_ipv6-frag & proto\_ipcv \\ \hline service\_pm\_dump & service\_red\_i & proto\_netblt & proto\_iso\_tp4 \\ \hline service\_remote\_job & service\_supdup & proto\_pvp & proto\_pgm \\ \hline service\_telnet & service\_tftp\_u & proto\_sdrp & proto\_scps \\ \hline service\_uucp & service\_uucp\_path & proto\_tlsp & proto\_secure-vmtp \\ \hline service\_vmnet & service\_whois & proto\_trunk-2 & proto\_tp++ \\ \hline flag\_REJ & flag\_RSTO & proto\_vines & proto\_ttp \\ \hline flag\_RSTR & flag\_S1 & proto\_wb-mon & \\ \hline flag\_S3 & flag\_SF & & \\ \hline \hline \end{tabular}
\end{table}
Table 3: Important features from Wrapper Method.  
earlier, namely, a hybrid of CNN+LSTM proposed in [54], BiLSTM, GRU, Decision Tree and Random Forest. Based on how accuracy increases with every instance, the meta-learner dynamically adds and adapts its training to include new features to the already existing features used for prediction. Hence the meta-learner dynamically determines on per-instance training results as to what features are important for generating a high prediction accuracy.