Intrusion detection systems (IDSs) have become a necessary component of computers and information security framework. IDSs commonly deal with a large amount of data traffic and these data may contain redundant and unimportant features. Choosing the best quality of features that represent all of the data and exclude the redundant features is a crucial topic in IDSs. In this paper, a new combination approach based on the ID3 algorithm and the bees algorithm (BA) is proposed to select the optimal subset of features for an IDS. The BA is used to generate a subset of features, and the ID3 algorithm is used as a classifier. The proposed model is applied on KDD Cup 99 dataset. The obtained results show that the feature subset generated by the proposed ID3-BA gives a higher accuracy and detection rate with a lower false alarm rate when compared to the results obtained by using all features.