{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,30]],"date-time":"2026-01-30T07:43:30Z","timestamp":1769759010056,"version":"3.49.0"},"reference-count":45,"publisher":"MDPI AG","issue":"23","license":[{"start":{"date-parts":[[2022,11,25]],"date-time":"2022-11-25T00:00:00Z","timestamp":1669334400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>With recent advancements in artificial intelligence (AI) and next-generation communication technologies, the demand for Internet-based applications and intelligent digital services is increasing, leading to a significant rise in cyber-attacks such as Distributed Denial-of-Service (DDoS). AI-based DoS detection systems promise adequate identification accuracy with lower false alarms, significantly associated with the data quality used to train the model. Several works have been proposed earlier to select optimum feature subsets for better model generalization and faster learning. However, there is a lack of investigation in the existing literature to identify a common optimum feature set for three main AI methods: machine learning, deep learning, and unsupervised learning. The current works are compromised either with the variation of the feature selection (FS) method or limited to one type of AI model for performance evaluation. Therefore, in this study, we extensively investigated and evaluated the performance of 15 individual FS methods from three major categories: filter-based, wrapper-based, and embedded, and one ensemble feature selection (EnFS) technique. Furthermore, the individual feature subset\u2019s quality is evaluated using supervised and unsupervised learning methods for extracting a common best-performing feature subset. According to our experiment, the EnFS method outperforms individual FS and provides a universal best feature set for all kinds of AI models.<\/jats:p>","DOI":"10.3390\/s22239144","type":"journal-article","created":{"date-parts":[[2022,11,25]],"date-time":"2022-11-25T03:34:24Z","timestamp":1669347264000},"page":"9144","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":15,"title":["Towards an Optimized Ensemble Feature Selection for DDoS Detection Using Both Supervised and Unsupervised Method"],"prefix":"10.3390","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1429-9387","authenticated-orcid":false,"given":"Sajal","family":"Saha","sequence":"first","affiliation":[{"name":"Department of Computer Science, Western University, London, ON N6A 3K7, Canada"}]},{"given":"Annita Tahsin","family":"Priyoti","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Western University, London, ON N6A 3K7, Canada"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2601-027X","authenticated-orcid":false,"given":"Aakriti","family":"Sharma","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Western University, London, ON N6A 3K7, Canada"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5253-0455","authenticated-orcid":false,"given":"Anwar","family":"Haque","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Western University, London, ON N6A 3K7, Canada"}]}],"member":"1968","published-online":{"date-parts":[[2022,11,25]]},"reference":[{"key":"ref_1","unstructured":"Tunggal, A. (2021, November 15). Why Is Cybersecurity Important? UpGuard. Available online: https:\/\/www.upguard.com\/blog\/cybersecurity-important."},{"key":"ref_2","unstructured":"Brownlee, J. (2021, November 15). Feature Selection to Improve Accuracy and Decrease Training Time. Available online: https:\/\/machinelearningmastery.com\/feature-selection-to-improve-accuracy-and-decrease-training-time\/."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"105","DOI":"10.1007\/s40747-017-0060-x","article-title":"EFS-MI: An ensemble feature selection method for classification","volume":"4","author":"Hoque","year":"2018","journal-title":"Complex Intell. Syst."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"5951","DOI":"10.1007\/s00521-019-04082-3","article-title":"Ensemble feature selection for high-dimensional data: A stability analysis across multiple domains","volume":"32","author":"Pes","year":"2020","journal-title":"Neural Comput. Appl."},{"key":"ref_5","first-page":"1","article-title":"Feature selection: A data perspective","volume":"50","author":"Li","year":"2017","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"295","DOI":"10.1016\/j.cose.2004.09.008","article-title":"Feature deduction and ensemble design of intrusion detection systems","volume":"24","author":"Chebrolu","year":"2005","journal-title":"Comput. Secur."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"1184","DOI":"10.1016\/j.jnca.2011.01.002","article-title":"Mutual information-based feature selection for intrusion detection systems","volume":"34","author":"Amiri","year":"2011","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Das, S., Mahfouz, A., Venugopal, D., and Shiva, S. (2019, January 22\u201326). DDoS intrusion detection through machine learning ensemble. Proceedings of the 2019 IEEE 19th International Conference on Software Quality, Reliability and Security Companion (QRS-C), Sofia, Bulgaria.","DOI":"10.1109\/QRS-C.2019.00090"},{"key":"ref_9","first-page":"139","article-title":"One-class SVMs for document classification","volume":"2","author":"Manevitz","year":"2001","journal-title":"J. Mach. Learn. Res."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Tang, T., Mhamdi, L., Zaidi, S., El-moussa, F., McLernon, D., and Ghogho, M. (2019, January 15\u201317). A deep learning approach combining auto-encoder with one-class SVM for DDoS attack detection in SDNs. Proceedings of the International Conference on Communications and Networking, Chongqing, China.","DOI":"10.1109\/ComNet47917.2020.9306073"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Cheng, Z., Zou, C., and Dong, J. (2019, January 24\u201327). Outlier detection using isolation forest and local outlier factor. Proceedings of the Conference on Research in Adaptive and Convergent Systems, Chongqing, China.","DOI":"10.1145\/3338840.3355641"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Saha, S., Priyoti, A., Sharma, A., and Haque, A. (2022, January 8\u201311). Towards an Optimal Feature Selection Method for AI-Based DDoS Detection System. Proceedings of the 2022 IEEE 19th Annual Consumer Communications Networking Conference (CCNC), Las Vegas, TX, USA.","DOI":"10.1109\/CCNC49033.2022.9700569"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"11994","DOI":"10.1016\/j.eswa.2009.05.029","article-title":"Intrusion detection by machine learning: A review","volume":"36","author":"Tsai","year":"2009","journal-title":"Expert Syst. Appl."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Mukkamala, S., Sung, A., and Abraham, A. (2003). Intrusion detection using ensemble of soft computing paradigms. Intelligent Systems Design and Applications, Springer.","DOI":"10.1007\/978-3-540-44999-7_23"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3054925","article-title":"A survey on ensemble learning for data stream classification","volume":"50","author":"Gomes","year":"2017","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"e1249","DOI":"10.1002\/widm.1249","article-title":"Ensemble learning: A survey","volume":"8","author":"Sagi","year":"2018","journal-title":"Wiley Interdiscip. Rev. Data Min. Knowl. Discov."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"82512","DOI":"10.1109\/ACCESS.2019.2923640","article-title":"An adaptive ensemble machine learning model for intrusion detection","volume":"7","author":"Gao","year":"2019","journal-title":"IEEE Access"},{"key":"ref_18","unstructured":"Pham, N., Foo, E., Suriadi, S., Jeffrey, H., and Lahza, H. (February, January 29). Improving performance of intrusion detection system using ensemble methods and feature selection. Proceedings of the Australasian Computer Science Week Multiconference, Brisbane, QLD, Australia."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"108156","DOI":"10.1016\/j.compeleceng.2022.108156","article-title":"Recurrent deep learning-based feature fusion ensemble meta-classifier approach for intelligent network intrusion detection system","volume":"102","author":"Ravi","year":"2022","journal-title":"Comput. Electr. Eng."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"16","DOI":"10.1016\/j.compeleceng.2013.11.024","article-title":"A survey on feature selection methods","volume":"40","author":"Chandrashekar","year":"2014","journal-title":"Comput. Electr. Eng."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"141","DOI":"10.1016\/j.patcog.2016.11.003","article-title":"A survey on semi-supervised feature selection methods","volume":"64","author":"Sheikhpour","year":"2017","journal-title":"Pattern Recognit."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Khalid, S., Khalil, T., and Nasreen, S. (2014, January 27\u201329). A survey of feature selection and feature extraction techniques in machine learning. Proceedings of the 2014 Science and Information Conference, London, UK.","DOI":"10.1109\/SAI.2014.6918213"},{"key":"ref_23","unstructured":"Molina, L., Belanche, L., and Nebot, \u00c0. (2002, January 9\u201312). Feature selection algorithms: A survey and experimental evaluation. Proceedings of the 2002 IEEE International Conference on Data Mining, Maebashi City, Japan."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"1739","DOI":"10.1007\/s10462-017-9581-3","article-title":"A survey of feature selection methods for Gaussian mixture models and hidden Markov models","volume":"52","author":"Adams","year":"2019","journal-title":"Artif. Intell. Rev."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"3285","DOI":"10.1016\/j.asoc.2012.05.004","article-title":"An intelligent algorithm with feature selection and decision rules applied to anomaly intrusion detection","volume":"12","author":"Lin","year":"2012","journal-title":"Appl. Soft Comput."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s13638-016-0623-3","article-title":"Ensemble-based multi-filter feature selection method for DDoS detection in cloud computing","volume":"2016","author":"Osanaiye","year":"2016","journal-title":"EURASIP J. Wirel. Commun. Netw."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Das, S., Venugopal, D., Shiva, S., and Sheldon, F. (2020, January 1\u20133). Empirical evaluation of the ensemble framework for feature selection in ddos attack. Proceedings of the 2020 International Conference on Edge Computing and Scalable Cloud (EdgeCom), New York, NY, USA.","DOI":"10.1109\/CSCloud-EdgeCom49738.2020.00019"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"131","DOI":"10.3233\/IDA-1997-1302","article-title":"Feature selection for classification","volume":"1","author":"Dash","year":"1997","journal-title":"Intell. Data Anal."},{"key":"ref_29","unstructured":"Wang, Y., Wong, J., and Miner, A. (2004, January 10\u201311). Anomaly intrusion detection using one class SVM. Proceedings of the Fifth Annual IEEE SMC Information Assurance Workshop, West Point, NY, USA."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"121","DOI":"10.1016\/j.patcog.2016.03.028","article-title":"High-dimensional and large-scale anomaly detection using a linear one-class SVM with deep learning","volume":"58","author":"Erfani","year":"2016","journal-title":"Pattern Recognit."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"755","DOI":"10.1007\/s11704-015-5116-8","article-title":"Local outlier factor and stronger one class classifier based hierarchical model for detection of attacks in network intrusion detection dataset","volume":"10","author":"Vasudevan","year":"2016","journal-title":"Front. Comput. Sci."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Lazarevic, A., Ertoz, L., Kumar, V., Ozgur, A., and Srivastava, J. (2003, January 1\u20133). A comparative study of anomaly detection schemes in network intrusion detection. Proceedings of the 2003 SIAM international Conference on Data Mining, San Francisco, CA, USA.","DOI":"10.1137\/1.9781611972733.3"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Amer, M., Goldstein, M., and Abdennadher, S. (2013, January 10\u201314). Enhancing one-class support vector machines for unsupervised anomaly detection. Proceedings of the ACM SIGKDD Workshop on Outlier Detection and Description, Chicago, IL, USA.","DOI":"10.1145\/2500853.2500857"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Alshawabkeh, M., Jang, B., and Kaeli, D. (2010, January 14). Accelerating the local outlier factor algorithm on a GPU for intrusion detection systems. Proceedings of the 3rd Workshop on General-Purpose Computation on Graphics Processing Units, Pittsburg, PA, USA.","DOI":"10.1145\/1735688.1735707"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Karev, D., McCubbin, C., and Vaulin, R. (2017, January 23\u201324). Cyber threat hunting through the use of an isolation forest. Proceedings of the 18th International Conference on Computer Systems and Technologies, Ruse, Bulgaria.","DOI":"10.1145\/3134302.3134319"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"1550147718814471","DOI":"10.1177\/1550147718814471","article-title":"A parallel algorithm for network traffic anomaly detection based on Isolation Forest","volume":"14","author":"Tao","year":"2018","journal-title":"Int. J. Distrib. Sens. Netw."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"157","DOI":"10.1007\/s10994-013-5337-8","article-title":"Unsupervised feature selection with ensemble learning","volume":"98","author":"Elghazel","year":"2015","journal-title":"Mach. Learn."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"41525","DOI":"10.1109\/ACCESS.2019.2895334","article-title":"Deep learning approach for intelligent intrusion detection system","volume":"7","author":"Vinayakumar","year":"2019","journal-title":"IEEE Access"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Vinayakumar, R., Soman, K., and Poornachandran, P. (2017, January 13\u201316). Evaluating effectiveness of shallow and deep networks to intrusion detection system. Proceedings of the 2017 International Conference on Advances in Computing, Communications and Informatics (ICACCI), Manipal, Karnataka, India.","DOI":"10.1109\/ICACCI.2017.8126018"},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_41","first-page":"2825","article-title":"Scikit-learn: Machine Learning in Python","volume":"12","author":"Pedregosa","year":"2011","journal-title":"J. Mach. Learn. Res."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"717","DOI":"10.1007\/s12652-020-02054-3","article-title":"Consensus and majority vote feature selection methods and a detection technique for web phishing","volume":"12","author":"Alotaibi","year":"2020","journal-title":"J. Ambient. Intell. Humaniz. Comput."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Ketkar, N. (2017). Introduction to keras. Deep Learning With Python, Apress.","DOI":"10.1007\/978-1-4842-2766-4"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 5). The significant features of the UNSW-NB15 and the KDD99 data sets for network intrusion detection systems. Proceedings of the 2015 4th International Workshop on Building Analysis Datasets and Gathering Experience Returns For Security (BADGERS), Kyoto, Japan.","DOI":"10.1109\/BADGERS.2015.014"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s40537-020-00379-6","article-title":"Performance analysis of intrusion detection systems using a feature selection method on the UNSW-NB15 dataset","volume":"7","author":"Kasongo","year":"2020","journal-title":"J. Big Data"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/23\/9144\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T01:26:29Z","timestamp":1760145989000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/23\/9144"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,11,25]]},"references-count":45,"journal-issue":{"issue":"23","published-online":{"date-parts":[[2022,12]]}},"alternative-id":["s22239144"],"URL":"https:\/\/doi.org\/10.3390\/s22239144","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,11,25]]}}}