Feature Selection for Deep Neural Networks in Cyber Security Applications

To stay ahead of novel attacks, cyber security professionals are developing new software and systems using machine learning techniques. Neural network architectures improve such systems, e.g., IDS, by implementing anomaly detection, which differentiates benign packets from malicious packets. In order for an IDS to best predict anomalies, the data the model is trained on is typically pre-processed through normalization and feature selection/reduction. The impacts of pre-processing techniques play an important role in training a neural network to optimize its performance. This paper proposes a DNN with 2 hidden layers for the IDS architecture and compares two commonly used normalization pre-processing techniques. We find that using Z Score normalization increased performance in accuracy by 4.46% reduced loss by 2.04%, improved F-Score by 4.70%, and increased AUC-ROC by 23.64%.