{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,7]],"date-time":"2026-04-07T06:42:34Z","timestamp":1775544154039,"version":"3.50.1"},"reference-count":50,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2023,2,5]],"date-time":"2023-02-05T00:00:00Z","timestamp":1675555200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2023,2,5]],"date-time":"2023-02-05T00:00:00Z","timestamp":1675555200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"Ministry of Business, Innovation, and Employment (MBIE) of New Zealand","award":["MAUX1912"],"award-info":[{"award-number":["MAUX1912"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Big Data"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>The effectiveness of machine learning models can be significantly averse to redundant and irrelevant features present in the large dataset which can cause drastic performance degradation. This paper proposes IGRF-RFE: a hybrid feature selection method tasked for multi-class network anomalies using a multilayer perceptron (MLP) network. IGRF-RFE exploits the qualities of both a filter method for its speed and a wrapper method for its relevance search. In the first phase of our approach, we use a combination of two filter methods, information gain (IG) and random forest (RF) respectively, to reduce the feature subset search space. By combining these two filter methods, the influence of less important features but with the high-frequency values selected by IG is more effectively managed by RF resulting in more relevant features to be included in the feature subset search space. In the second phase of our approach, we use a machine learning-based wrapper method that provides a recursive feature elimination (RFE) to further reduce feature dimensions while taking into account the relevance of similar features. Our experimental results obtained based on the UNSW-NB15 dataset confirmed that our proposed method can improve the accuracy of anomaly detection as it can select more relevant features while reducing the feature space. The results show that the feature is reduced from 42 to 23 while the multi-classification accuracy of MLP is improved from 82.25% to 84.24%.<\/jats:p>","DOI":"10.1186\/s40537-023-00694-8","type":"journal-article","created":{"date-parts":[[2023,2,5]],"date-time":"2023-02-05T15:02:44Z","timestamp":1675609364000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":266,"title":["IGRF-RFE: a hybrid feature selection method for MLP-based network intrusion detection on UNSW-NB15 dataset"],"prefix":"10.1186","volume":"10","author":[{"given":"Yuhua","family":"Yin","sequence":"first","affiliation":[]},{"given":"Julian","family":"Jang-Jaccard","sequence":"additional","affiliation":[]},{"given":"Wen","family":"Xu","sequence":"additional","affiliation":[]},{"given":"Amardeep","family":"Singh","sequence":"additional","affiliation":[]},{"given":"Jinting","family":"Zhu","sequence":"additional","affiliation":[]},{"given":"Fariza","family":"Sabrina","sequence":"additional","affiliation":[]},{"given":"Jin","family":"Kwak","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2023,2,5]]},"reference":[{"key":"694_CR1","unstructured":"Stouffer C. \u201c115 cybersecurity statistics and trends you need to know in 2021,\u201d 2021, accessed 2022-02-22. https:\/\/us.norton.com\/internetsecurity-emerging-threats-cyberthreat-trends-cybersecurity-threat-review.html"},{"key":"694_CR2","doi-asserted-by":"crossref","unstructured":"Lazarevic A, Kumar V, Srivastava J. Intrusion detection: a survey. In Managing cyber threats. Springer, pp. 19\u201378 2005.","DOI":"10.1007\/0-387-24230-9_2"},{"key":"694_CR3","doi-asserted-by":"crossref","unstructured":"Latha S, Prakash SJ. A survey on network attacks and intrusion detection systems. In 2017 4th International Conference on Advanced Computing and Communication Systems (ICACCS). IEEE, pp. 1\u20137 2017.","DOI":"10.1109\/ICACCS.2017.8014614"},{"issue":"5","key":"694_CR4","doi-asserted-by":"publisher","first-page":"973","DOI":"10.1016\/j.jcss.2014.02.005","volume":"80","author":"J Jang-Jaccard","year":"2014","unstructured":"Jang-Jaccard J, Nepal S. A survey of emerging threats in cybersecurity. J Comput Syst Sci. 2014;80(5):973\u201393.","journal-title":"J Comput Syst Sci"},{"key":"694_CR5","doi-asserted-by":"publisher","first-page":"222","DOI":"10.1109\/TSE.1987.232894","volume":"2","author":"DE Denning","year":"1987","unstructured":"Denning DE. An intrusion-detection model. IEEE Trans Softw Eng. 1987;2:222\u201332.","journal-title":"IEEE Trans Softw Eng"},{"key":"694_CR6","doi-asserted-by":"crossref","unstructured":"Singh R, Kumar H, Singla RK, Ketti RR. Internet attacks and intrusion detection system: a review of the literature. Online Information Review, 2017.","DOI":"10.1108\/OIR-12-2015-0394"},{"issue":"7","key":"694_CR7","doi-asserted-by":"publisher","first-page":"4349","DOI":"10.1016\/j.asoc.2010.12.004","volume":"11","author":"HT Elshoush","year":"2011","unstructured":"Elshoush HT, Osman IM. Alert correlation in collaborative intelligent intrusion detection systems-a survey. Appl Soft Comput. 2011;11(7):4349\u201365.","journal-title":"Appl Soft Comput"},{"issue":"1","key":"694_CR8","doi-asserted-by":"publisher","first-page":"497","DOI":"10.1007\/s12652-020-02014-x","volume":"12","author":"A Drewek-Ossowicka","year":"2021","unstructured":"Drewek-Ossowicka A, Pietro\u0142aj M, Rumi\u0144ski J. A survey of neural networks usage for intrusion detection systems. J Ambient Intell Humaniz Comput. 2021;12(1):497\u2013514.","journal-title":"J Ambient Intell Humaniz Comput"},{"issue":"2","key":"694_CR9","doi-asserted-by":"publisher","first-page":"56","DOI":"10.38094\/jastt1224","volume":"1","author":"R Zebari","year":"2020","unstructured":"Zebari R, Abdulazeez A, Zeebaree D, Zebari D, Saeed J. A comprehensive review of dimensionality reduction techniques for feature selection and feature extraction. J Appl Sci Technol Trends. 2020;1(2):56\u201370.","journal-title":"J Appl Sci Technol Trends"},{"issue":"1","key":"694_CR10","doi-asserted-by":"publisher","first-page":"257","DOI":"10.1007\/s11063-020-10383-9","volume":"53","author":"J Zhu","year":"2021","unstructured":"Zhu J, Jang-Jaccard J, Liu T, Zhou J. Joint spectral clustering based on optimal graph and feature selection. Neural Process Lett. 2021;53(1):257\u201373.","journal-title":"Neural Process Lett"},{"key":"694_CR11","unstructured":"Dua M, et al. Machine learning approach to ids: a comprehensive review. In: 3rd International conference on Electronics, Communication and Aerospace Technology (ICECA). IEEE. 2019;2019:117\u201321."},{"key":"694_CR12","doi-asserted-by":"publisher","first-page":"102691","DOI":"10.1016\/j.cose.2022.102691","volume":"117","author":"J Zhu","year":"2022","unstructured":"Zhu J, Jang-Jaccard J, Singh A, Welch I, Harith A-S, Camtepe S. A few-shot meta-learning based siamese neural network using entropy features for ransomware classification. Comput Secur. 2022;117:102691.","journal-title":"Comput Secur"},{"issue":"3","key":"694_CR13","doi-asserted-by":"publisher","first-page":"41","DOI":"10.3390\/computers11030041","volume":"11","author":"H Alavizadeh","year":"2022","unstructured":"Alavizadeh H, Alavizadeh H, Jang-Jaccard J. Deep q-learning based reinforcement learning approach for network intrusion detection. Computers. 2022;11(3):41.","journal-title":"Computers"},{"issue":"1","key":"694_CR14","doi-asserted-by":"publisher","first-page":"32","DOI":"10.3390\/s22010032","volume":"22","author":"T Liu","year":"2021","unstructured":"Liu T, Sabrina F, Jang-Jaccard J, Xu W, Wei Y. Artificial intelligence-enabled ddos detection for blockchain-based smart transport systems. Sensors. 2021;22(1):32.","journal-title":"Sensors"},{"key":"694_CR15","doi-asserted-by":"publisher","first-page":"146 810","DOI":"10.1109\/ACCESS.2021.3123791","volume":"9","author":"Y Wei","year":"2021","unstructured":"Wei Y, Jang-Jaccard J, Sabrina F, Singh A, Xu W, Camtepe S. Ae-mlp: a hybrid deep learning approach for ddos detection and classification. IEEE Access. 2021;9:146 810-146 821.","journal-title":"IEEE Access"},{"key":"694_CR16","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2020.114444","volume":"168","author":"AU Haq","year":"2021","unstructured":"Haq AU, Zeb A, Lei Z, Zhang D. Forecasting daily stock trend using multi-filter feature selection and deep learning. Expert Syst Appl. 2021;168: 114444.","journal-title":"Expert Syst Appl"},{"key":"694_CR17","volume-title":"Feature engineering for machine learning and data analytics","author":"G Dong","year":"2018","unstructured":"Dong G, Liu H. Feature engineering for machine learning and data analytics. Boca Raton: CRC Press; 2018."},{"issue":"7","key":"694_CR18","doi-asserted-by":"publisher","first-page":"8144","DOI":"10.1016\/j.eswa.2010.12.156","volume":"38","author":"H-H Hsu","year":"2011","unstructured":"Hsu H-H, Hsieh C-W, Lu M-D. Hybrid feature selection by combining filters and wrappers. Expert Syst Appl. 2011;38(7):8144\u201350.","journal-title":"Expert Syst Appl"},{"key":"694_CR19","doi-asserted-by":"crossref","unstructured":"Jovi\u0107 A, Brki\u0107 K, Bogunovi\u0107 N. A review of feature selection methods with applications. In: 38th international convention on information and communication technology, electronics and microelectronics (MIPRO). IEEE. 2015;2015:1200\u20135.","DOI":"10.1109\/MIPRO.2015.7160458"},{"key":"694_CR20","doi-asserted-by":"crossref","unstructured":"S\u00e1nchez-Marono N, Alonso-Betanzos A, Tombilla-Sanrom\u00e1n M. Filter methods for feature selection\u2013a comparative study. In International Conference on Intelligent Data Engineering and Automated Learning. Springer, pp. 178\u2013187. 2007.","DOI":"10.1007\/978-3-540-77226-2_19"},{"issue":"3","key":"694_CR21","doi-asserted-by":"publisher","first-page":"703","DOI":"10.1109\/JAS.2019.1911447","volume":"6","author":"H Liu","year":"2019","unstructured":"Liu H, Zhou M, Liu Q. An embedded feature selection method for imbalanced data classification. IEEE\/CAA Journal of Autom Sinica. 2019;6(3):703\u201315.","journal-title":"IEEE\/CAA J Autom Sinica"},{"key":"694_CR22","doi-asserted-by":"crossref","unstructured":"El\u00a0Aboudi N, Benhlima L. Review on wrapper feature selection approaches. In 2016 International Conference on Engineering & MIS (ICEMIS). IEEE, pp. 1\u20135. 2016.","DOI":"10.1109\/ICEMIS.2016.7745366"},{"key":"694_CR23","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2020.107247","volume":"174","author":"Y Zhou","year":"2020","unstructured":"Zhou Y, Cheng G, Jiang S, Dai M. Building an efficient intrusion detection system based on feature selection and ensemble classifier. Computer networks. 2020;174: 107247.","journal-title":"Computer networks"},{"key":"694_CR24","doi-asserted-by":"crossref","unstructured":"Li L, Yu Y, Bai S, Cheng J, Chen X. Towards effective network intrusion detection: a hybrid model integrating gini index and gbdt with PSO. J Sensors. 2018;2018.","DOI":"10.1155\/2018\/1578314"},{"issue":"1","key":"694_CR25","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s40537-020-00379-6","volume":"7","author":"SM Kasongo","year":"2020","unstructured":"Kasongo SM, Sun Y. Performance analysis of intrusion detection systems using a feature selection method on the unsw-nb15 dataset. J Big Data. 2020;7(1):1\u201320.","journal-title":"J Big Data"},{"key":"694_CR26","doi-asserted-by":"crossref","unstructured":"Eunice AD, Gao Q, Zhu M-Y, Chen Z, Na L. Network anomaly detection technology based on deep learning. In 2021 IEEE 3rd International Conference on Frontiers Technology of Information and Computer (ICFTIC). IEEE, pp. 6\u20139, 2021.","DOI":"10.1109\/ICFTIC54370.2021.9647222"},{"key":"694_CR27","doi-asserted-by":"crossref","unstructured":"Prasad M, Gupta RK, Tripathi S. A multi-level correlation-based feature selection for intrusion detection. Arab J Sci Eng. 2022;1\u201311.","DOI":"10.1007\/s13369-022-06760-2"},{"key":"694_CR28","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2020.113249","volume":"148","author":"H Alazzam","year":"2020","unstructured":"Alazzam H, Sharieh A, Sabri KE. A feature selection algorithm for intrusion detection system based on pigeon inspired optimizer. Expert Syst Appl. 2020;148: 113249.","journal-title":"Expert Syst Appl"},{"key":"694_CR29","doi-asserted-by":"crossref","unstructured":"Zhang Y, Ren X, Zhang J. Intrusion detection method based on information gain and relieff feature selection. In 2019 International Joint Conference on Neural Networks (IJCNN). IEEE, pp. 1\u20135, 2019.","DOI":"10.1109\/IJCNN.2019.8851756"},{"key":"694_CR30","doi-asserted-by":"crossref","unstructured":"Megantara AA, Ahmad T. Feature importance ranking for increasing performance of intrusion detection system. In: 2020 3rd International Conference on Computer and Informatics Engineering (IC2IE). IEEE, pp. 37\u201342, 2020.","DOI":"10.1109\/IC2IE50715.2020.9274570"},{"key":"694_CR31","doi-asserted-by":"crossref","unstructured":"Ustebay S, Turgut Z, Aydin MA. Intrusion detection system with recursive feature elimination by using random forest and deep learning classifier. In: international congress on big data, deep learning and fighting cyber terrorism (IBIGDELFT). IEEE. 2018;2018:71\u20136.","DOI":"10.1109\/IBIGDELFT.2018.8625318"},{"key":"694_CR32","doi-asserted-by":"crossref","unstructured":"Zong W, Chow Y-W, Susilo W. A two-stage classifier approach for network intrusion detection. In: International Conference on Information Security Practice and Experience. Springer, pp. 329\u2013340, 2018.","DOI":"10.1007\/978-3-319-99807-7_20"},{"issue":"2","key":"694_CR33","doi-asserted-by":"publisher","first-page":"1397","DOI":"10.1007\/s10586-019-03008-x","volume":"23","author":"V Kumar","year":"2020","unstructured":"Kumar V, Sinha D, Das AK, Pandey SC, Goswami RT. An integrated rule based intrusion detection system: analysis on unsw-nb15 data set and the real time online dataset. Clust Comput. 2020;23(2):1397\u2013418.","journal-title":"Clust Comput"},{"key":"694_CR34","doi-asserted-by":"crossref","unstructured":"Dhal P, Azad C. A comprehensive survey on feature selection in the various fields of machine learning. Appl Intell. 2021;1\u201339.","DOI":"10.1007\/s10489-021-02550-9"},{"issue":"6","key":"694_CR35","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3136625","volume":"50","author":"J Li","year":"2017","unstructured":"Li J, Cheng K, Wang S, Morstatter F, Trevino RP, Tang J, Liu H. Feature selection: a data perspective. ACM Comput Surv. 2017;50(6):1\u201345.","journal-title":"ACM Comput Surv"},{"issue":"2","key":"694_CR36","doi-asserted-by":"publisher","first-page":"197","DOI":"10.1007\/s11749-016-0481-7","volume":"25","author":"G Biau","year":"2016","unstructured":"Biau G, Scornet E. A random forest guided tour. Test. 2016;25(2):197\u2013227.","journal-title":"Test"},{"key":"694_CR37","doi-asserted-by":"publisher","first-page":"132 911","DOI":"10.1109\/ACCESS.2020.3009843","volume":"8","author":"D Stiawan","year":"2020","unstructured":"Stiawan D, Idris MYB, Bamhdi AM, Budiarto R, et al. Cicids-2017 dataset feature analysis with information gain for anomaly detection. IEEE Access. 2020;8:132 911-132 921.","journal-title":"IEEE Access"},{"key":"694_CR38","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4614-6849-3","volume-title":"Applied predictive modeling","author":"M Kuhn","year":"2013","unstructured":"Kuhn M, Johnson K, et al. Applied predictive modeling, vol. 26. Cham: Springer; 2013."},{"key":"694_CR39","doi-asserted-by":"crossref","unstructured":"Taud H, Mas J. Multilayer perceptron (mlp), In: Geomatic approaches for modeling land change scenarios. Springer, pp. 451\u2013455, 2018.","DOI":"10.1007\/978-3-319-60801-3_27"},{"key":"694_CR40","unstructured":"Ioffe S, Szegedy C. Batch normalization: accelerating deep network training by reducing internal covariate shift. In: International conference on machine learning. PMLR, pp. 448\u2013456, 2015."},{"key":"694_CR41","unstructured":"KDDCup1999. 2007. http:\/\/kdd.ics.uci.edu\/databases\/kddcup99\/KDDCUP99.htm"},{"key":"694_CR42","doi-asserted-by":"crossref","unstructured":"Tavallaee M, Bagheri E, Lu W, Ghorbani AA. A detailed analysis of the kdd cup 99 data set. In: IEEE symposium on computational intelligence for security and defense applications. Ieee. 2009;2009:1\u20136.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"694_CR43","doi-asserted-by":"crossref","unstructured":"Moustafa N, Slay J. Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set). In: military communications and information systems conference (MilCIS). IEEE. 2015;2015:1\u20136.","DOI":"10.1109\/MilCIS.2015.7348942"},{"issue":"1\u20133","key":"694_CR44","first-page":"18","volume":"25","author":"N Moustafa","year":"2016","unstructured":"Moustafa N, Slay J. The evaluation of network anomaly detection systems: statistical analysis of the unsw-nb15 data set and the comparison with the kdd99 data set. Inf Secur J. 2016;25(1\u20133):18\u201331.","journal-title":"Inf Secur J"},{"key":"694_CR45","doi-asserted-by":"crossref","unstructured":"Patro S, Sahu KK. Normalization: a preprocessing stage. arXiv preprintarXiv:1503.06462, 2015.","DOI":"10.17148\/IARJSET.2015.2305"},{"key":"694_CR46","volume-title":"Artificial intelligence: a modern approach","author":"S Russell","year":"2010","unstructured":"Russell S, Norvig P. Artificial intelligence: a modern approach, vol. 7458. 3rd ed. Upper Saddle River: Pearson Education; 2010.","edition":"3"},{"key":"694_CR47","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4614-6849-3","volume-title":"Applied predictive modeling","author":"M Kuhn","year":"2013","unstructured":"Kuhn M, Johnson K, et al. Applied predictive modeling, vol. 26. Berlin: Springer; 2013."},{"key":"694_CR48","doi-asserted-by":"crossref","unstructured":"Roy A, Singh KJ. Multi-classification of unsw-nb15 dataset for network anomaly detection system. In Proceedings of International Conference on Communication and Computational Technologies. Springer, pp. 429\u2013451, 2021.","DOI":"10.1007\/978-981-15-5077-5_40"},{"key":"694_CR49","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101752","volume":"92","author":"SM Kasongo","year":"2020","unstructured":"Kasongo SM, Sun Y. A deep learning method with wrapper based feature extraction for wireless intrusion detection system. Comput Secur. 2020;92: 101752.","journal-title":"Comput Secur"},{"issue":"8","key":"694_CR50","doi-asserted-by":"publisher","first-page":"1035","DOI":"10.1111\/1754-9485.13393","volume":"66","author":"S Feng","year":"2022","unstructured":"Feng S, Liu Q, Patel A, Bazai SU, Jin C-K, Kim JS, Sarrafzadeh M, Azzollini D, Yeoh J, Kim E et\u00a0al. Automated pneumothorax triaging in chest X-rays in the new zealand population using deep-learning algorithms. J Med Imaging Radiat Oncol. 2022;66(8):1035\u201343.","journal-title":"J Med Imaging Radiat Oncol"}],"container-title":["Journal of Big Data"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s40537-023-00694-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s40537-023-00694-8\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s40537-023-00694-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,2,5]],"date-time":"2023-02-05T15:03:52Z","timestamp":1675609432000},"score":1,"resource":{"primary":{"URL":"https:\/\/journalofbigdata.springeropen.com\/articles\/10.1186\/s40537-023-00694-8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,2,5]]},"references-count":50,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2023,12]]}},"alternative-id":["694"],"URL":"https:\/\/doi.org\/10.1186\/s40537-023-00694-8","relation":{},"ISSN":["2196-1115"],"issn-type":[{"value":"2196-1115","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,2,5]]},"assertion":[{"value":"23 June 2022","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"21 January 2023","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"5 February 2023","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval and consent to participate"}},{"value":"The authors agree to publish this paper.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}},{"value":"The authors declare that they have no competing interests.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"15"}}