Feature selection using genetic algorithm for intrusion detection on resource-constrained edge devices

Intrusion Detection (ID) systems play a crucial role in protecting computer networks from growing number of cyber threats, with Machine Learning (ML) algorithms emerging as highly effective tools in strengthening ID performance. In recent years, there has been a notable shift towards deploying ML algorithms for ID directly on edge devices, to enhance performance and increase data privacy. However, this requires ML models to be optimized for resource-constrained devices. This paper is focused on applying genetic algorithm for feature selection in ML-based ID systems deployed on edge devices. It investigates how feature selection impacts the performance of various ML algorithms, including decision tree, random forest, and artificial neural network. The study is conducted using publicly available Westermo network traffic dataset and evaluated for live network traffic classification on an edge device manufactured by Westermo Network Technologies. Using only features selected by genetic algorithm resulted in a reduction of 14–26% for peak memory consumption and 23–40% for total memory consumption and decreased detection time by 24–69%, depending on the algorithm, while maintaining system classification performance. Together with the increasing computational power of edge devices, these results facilitate the application of edge ML by reducing system requirements concerning memory and processing time.