Hybrid Recursive Feature Elimination and Principal Component Analysis for Dimensionality Reduction in Network Intrusion Detection on the UNSW-NB15 Dataset

Abstract

Machine-learning-based network intrusion detection is often limited by the high dimensionality of traffic records, whose redundant and correlated attributes increase computational cost. Recursive feature elimination (RFE) retains class-relevant attributes, whereas principal component analysis (PCA) decorrelates attributes without reference to class labels. This study evaluated a sequential pipeline in which RFE with a random-forest estimator retained 30 of the 42 attributes of the UNSW-NB15 dataset and PCA projected them onto 10 orthogonal components explaining 95.6% of their variance. The 175,341-record training partition of the dataset was split 70:30 by stratified sampling into 122,738 training and 52,603 testing records, and every transformer was fitted on the training records only. Four classifiers from different learning paradigms were evaluated with accuracy, precision, recall, F1-score, specificity, the area under the receiver operating characteristic curve (ROC-AUC) and the Matthews correlation coefficient (MCC), averaged over five runs, and compared with full-feature, RFE-only and PCA-only baselines. On the hybrid representation, the artificial neural network achieved the highest accuracy (93.72 ± 0.21%), ROC-AUC (0.982) and MCC (0.855), followed by k-nearest neighbour (93.41%; MCC 0.847), the support vector machine (91.56%; 0.806) and Gaussian naïve Bayes (86.82%; 0.698). All classifiers detected 90–99% of attacks but correctly identified only 76–87% of normal flows. Relative to the full attribute set, the hybrid representation reduced the input dimension by 76% with an MCC change between −0.041 and +0.017, and reduced k-nearest-neighbour testing time from 15.16 s to 0.73 s