Performance Evaluation of Machine Learning Models for Intrusion Detection: A Feature Selection Perspective

Intrusion Detection Systems (IDS) are essential for safeguarding network infrastructures by identifying unauthorized access and malicious activities. This study investigates the efficacy of various machine learning algorithms, such as Support Vector Machine (SVM), Random Forest (RF), XGBoost, and Long Short-Term Memory (LSTM) networks, in detecting intrusions using the NSL-KDD dataset. We focus on the impact of feature selection on model performance, employing an iterative feature removal process based on feature importance rankings. Our findings indicate that ensemble methods like RF and XGBoost consistently achieve high accuracy and recall across different feature subsets. LSTM networks are initially less effective with smaller feature sets. However, they demonstrate significant improvements in F1-score and precision when the number of features increases. SVMs exhibit stable performance, particularly with well-engineered feature sets. These insights provide valuable guidelines for selecting appropriate algorithms and feature selection strategies in the development of robust IDS.