A hybrid filter-wrapper feature selection method for DDoS detection in cloud computing

In today's rapidly emerging computing environment, cloud computing has become a significant trend for the delivery of IT business services, and representes a potential technology resource choice that offers cost effective and scalable processing. However, Distributed Denial of Service (DDoS) attacks continually target cloud services and resource availability, rendering the cloud unavailable to the detriment of both cloud providers and users. In previous research, feature selection, has revealed its importance in the recognition of irrelevant and redundant features, which increases detection rates and decreases processing speeds toward the evaluation of intrusive patterns, while reducing computational complexity. In this work we propose a Hybrid Filter-Wrapper Feature Selection HFWFS method for DDoS detection, which takes advantage of both filter and wrapper methods, to identify the most irrelevant and redundant features in order to form a reduced input subset. Subsequently, it applies a wrapper method to achieve the optimal selection of features. To evaluate the performance of our proposed model, we used two datasets (NSL-KDD and UNSW-NB15) and a Random Tree classifier. The results indicated that the proposed model may reduce the number of features from more than 40 to nine, while maintaining high detection accuracy, in contrast to well-known feature selection methods.