arXiv:2607.13203v1 [cs.CR] 14 Jul 2026
BARS: Benign-Anchored Ranking and Selection for False Alarm Reduction in Network Intrusion Detection 1st Abu Fuad Ahmad
2nd Istiaque Ahmed
Department of Computer Science New Mexico State University Las Cruces, New Mexico, USA [email protected]
Graduate School of Informatics Osaka Metropolitan University Osaka, Japan [email protected]
Abstract—False alarms remain one of the primary barriers to the operational deployment of network intrusion detection systems (NIDS): in high-volume environments, even a sub1% false positive rate produces tens of thousands of daily alerts, overwhelming security analysts and eroding trust in automated detection. Filter-based feature selection is an attractive lever for false alarm reduction because it operates upstream of the classifier and incurs no inference-time cost. Yet classical filters apply class-symmetric criteria that ignore the operational asymmetry of intrusion detection, in which benign traffic defines the baseline and attacks are deviations from it. A recent class-asymmetric filter, Classwise Mean Deviation (CMD), addresses this asymmetry but anchors its score to a global reference mean that drifts toward attack distributions under imbalance, attenuating precisely the deviations it is meant to capture. We propose Benign-Anchored Ranking and Selection (BARS), a two-stage filter that replaces CMD’s global anchor with the benign-class mean and follows the score with an order-preserving decorrelation step. We evaluate BARS on three NIDS benchmarks spanning the imbalance spectrum (CICIDS2017, CICDDoS2019, UNSW-NB15) across five feature budgets k ∈ {5, 10, 20, 30, 40}. The empirical pattern matches the design rationale: on attack-majority data, where the globalanchor bias is most severe, BARS reduces FPR over CMD by 15.4% on UNSW-NB15 at k = 20 and by 21–23% on CICDDoS2019 at small budgets, while preserving true positive rate and macro-F1. On benign-majority data, BARS and CMD converge, consistent with the theoretical limit in which the global and benign-anchored scores coincide. We position BARS narrowly: it is a principled refinement of CMD specifically, not a universally dominant filter; richer methods such as Pearson correlation and Mutual Information achieve lower FPR on several settings, though they exceeded 1 TB of memory on the larger benchmarks in our evaluation. BARS’s lineartime scoring and low memory footprint make it suited to deployments where richer methods cannot run. Index Terms—Network intrusion detection, feature selection, false alarm reduction, class imbalance, classwise mean deviation, cybersecurity
1. Introduction Network intrusion detection systems (NIDS) are a core component of modern cybersecurity infrastructure, tasked with identifying malicious activity in high-volume network traffic. Although machine-learning-based NIDS have substantially improved aggregate detection metrics over the past decade, their operational adoption remains constrained by a more fundamental problem: false alarms. In production deployments, the dominant bottleneck is rarely whether attacks are detected, but the rate at which benign traffic generates alerts. A NIDS operating at a 1% false positive rate (FPR) on a network handling 107 benign flows per day produces on the order of 105 false alerts daily—well beyond the triage capacity of typical security operations teams [1]. The downstream consequences—analyst fatigue, alert suppression, slowed incident response, and eroded trust in automated detection—are well documented [2]. Two intrinsic properties of network traffic data amplify the severity of false alarms. First, NIDS datasets are typically high-dimensional, with dozens to hundreds of flowlevel features extracted from each connection [3]. Second, they are often imbalanced, with class proportions varying widely across benchmarks and deployments [4]. Under these conditions, learning-based models tend to overfit to subtle variations within benign traffic, producing spurious detections and elevated FPR. Why feature selection. Existing approaches to false alarm reduction operate predominantly at the classifier or decision stage—through cost-sensitive learning, threshold tuning, or anomaly-score calibration [5]–[7]. These approaches share a structural limitation: they compensate for noise posthoc rather than eliminating it at the source. Feature selection, in contrast, operates upstream of the classifier. By removing features that vary within benign traffic but carry no attackdiscriminative signal, feature selection reduces the noise floor that classifiers must contend with, without introducing additional inference-time cost or coupling to any particular learning algorithm. Why existing filters fall short. Classical filter methods such as Mutual Information [8], Pearson correlation [9], and Fisher Score [10] rank features using globally symmetric
statistics that treat all classes equivalently. This symmetry is misaligned with the structure of intrusion detection, where benign traffic defines the operational baseline and attacks are naturally characterized as deviations from that baseline. Recent work introduced Classwise Mean Deviation (CMD) [11], which uses class-wise mean shifts for feature ranking and achieves competitive performance in NIDS tasks. However, CMD anchors its scoring to a global reference mean. Under class imbalance, this global mean drifts toward the dominant class, producing two related effects: when benign dominates, a non-zero benign self-deviation that rewards features varying within benign traffic; when attacks dominate, systematically attenuated attack-class deviations that underweight precisely the features CMD is meant to capture. Our approach. The core idea behind our method is to anchor feature scoring directly to the benign class rather than to a global reference. A benign anchor coincides with the operational baseline a NIDS must respect, eliminates the self-deviation that global-mean anchoring assigns to benign-varying features, and preserves the full magnitude of attack-class deviations regardless of training-time class composition. We embed this principle in Benign-Anchored Ranking and Selection (BARS), a two-stage filter: Stage 1 ranks features by their absolute mean deviation from benign traffic; Stage 2 walks the ranked list and admits each feature only if its correlation with all previously admitted features stays below a single threshold τ . The resulting method is classifier-agnostic, governed by one interpretable hyperparameter, and computes its scoring in O(N d) time. We evaluate BARS on three NIDS benchmarks spanning the imbalance spectrum (CICIDS2017, CICDDoS2019, UNSWNB15) and find that the empirical pattern matches the design rationale: on attack-majority data, where the globalanchor bias is most severe, BARS reduces FPR over CMD by 15–23% depending on dataset and budget; on benignmajority data, BARS and CMD converge, consistent with the theoretical limit in which the two scores coincide. Contributions. This paper makes the following contributions:
Scope. We position BARS narrowly. It is a principled refinement of CMD specifically, not a universally dominant filter: classical methods with richer scoring functions (Pearson, Mutual Information) achieve lower FPR than BARS on several (dataset, budget) combinations. BARS’s distinguishing value lies in its linear-time scoring and low memory footprint—properties most useful in deployments where richer methods cannot run, as evidenced by Fisher Score and Mutual Information exceeding 1 TB of memory on the larger benchmarks in our evaluation. The remainder of this paper is organized as follows. Section 2 reviews the NIDS pipeline, formalizes our threat model, and recaps CMD. Section 3 surveys related work in feature selection, false alarm reduction, and imbalanced learning. Section 4 introduces BARS and its design rationale. Section 5 describes the experimental setup, and Section 6 presents the empirical results. Section 7 discusses when benign anchoring helps, addresses adaptive adversaries, and considers deployment, and Section 8 concludes.
2. Background and Threat Model This section describes the NIDS pipeline in which BARS operates, formalizes the threat model, and recaps the Classwise Mean Deviation (CMD) method that BARS extends.
2.1. Network Intrusion Detection Pipeline A modern NIDS processes network traffic in four sequential stages: 1) 2)
3) 4)
•
•
•
We identify a structural failure mode in Classwise Mean Deviation (CMD), a recently proposed filter method for NIDS: its global anchor drifts toward the dominant class under imbalance, attenuating the very class-deviation signal it is designed to capture. We propose BARS, which replaces CMD’s global anchor with the benign-class mean and adds an order-preserving decorrelation step to prevent redundant feature selection. BARS is parameter-light, classifier-agnostic, and computes its scoring in O(N d) time. We show empirically that BARS’s advantage materializes precisely where the design rationale predicts: on attack-majority data, BARS reduces FPR over CMD by 15–23% with detection capability preserved; on benign-majority data, the two methods converge.
Traffic capture—raw packets or flows are collected from network sensors. Feature extraction—statistical and protocol-level features are computed over flow windows (e.g., packet counts, inter-arrival times, byte distributions). Feature selection or reduction—a subset of informative features is retained to reduce computational cost and overfitting. Classification—a learned model assigns each flow to a benign or attack class, and alerts are forwarded to a Security Operations Center (SOC) for analyst triage.
BARS operates at stage (iii). It is a univariate filter that scores features prior to classifier training and is agnostic to the downstream learning algorithm, making it a drop-in replacement for existing filter methods such as Mutual Information or Fisher Score. Because the operational cost of false alarms is realized at stage (iv), any reduction achieved at stage (iii) propagates directly to operational savings without coupling to classifier-specific design choices.
2.2. Threat Model We consider a defender who operates a NIDS trained on a labeled corpus of historical benign and attack traffic and
whose goal is to reduce the operational alert burden—i.e., minimize the false positive rate (FPR) while maintaining the true positive rate (TPR) above an acceptable threshold. The defender has full access to the training pipeline (feature extraction, feature selection, classifier training) and selects BARS as the feature selection component. The adversary seeks to inject malicious traffic—denialof-service, probing, exploitation, or data-exfiltration flows— without being flagged, and is assumed to follow attack patterns drawn from known families and commodity tooling. The adversary has no access to the training data, learned parameters, or selected feature subset of the deployed NIDS, and cannot poison the training corpus or tamper with packets after they leave its control. This is the non-adaptive setting, in which the attacktime traffic distribution is drawn from the same family as the training-time attack distribution. This scope reflects the dominant operational reality of contemporary NIDS deployments, where the majority of observed malicious traffic corresponds to known attack families. Defenses against adaptive adversaries that explicitly mimic benign feature distributions are an important complementary direction; we discuss the implications of adaptive adversaries for BARS’s design in Section 7.
2.3. Classwise Mean Deviation (CMD) BARS extends Classwise Mean Deviation (CMD) [11], a recently introduced filter method for intrusion detection. We recap CMD here to make the paper self-contained; the formal contrast with BARS is developed in Section 4.5. Let D = {(xi , yi )}N i=1 denote a labeled dataset, where xi ∈ Rd and yi ∈ {0, 1, . . . , C}, with y = 0 denoting benign traffic and y ∈ {1, . . . , C} denoting C attack classes. Let µc ∈ Rd be the mean vector of class c, and let µglobal ∈ Rd be the overall sample mean. CMD scores each feature j by the total absolute deviation of class means from this global reference: (CMD)
Dj
=
C X
|µc,j − µglobal,j | ,
3.1. Feature Selection for NIDS Feature selection is a long-studied preprocessing step for high-dimensional learning, and its application to network intrusion detection is well established. Filter-based methods—including Mutual Information [8], [12], Pearson correlation [9], Fisher Score [10], and variance-based filtering [13]—are particularly prevalent in NIDS pipelines because they are model-independent, scalable to high-volume traffic, and require no iterative training [14]. Recent surveys document the central role of filter methods in operational NIDS deployments and emphasize scalability as a deciding factor in practice [2], [3], [15], [16]. Wrapper and embedded methods (recursive feature elimination, ℓ1 -regularized classifiers, tree-based importances) can capture feature interactions and often achieve higher accuracy than filters, but their computational cost and tight coupling to a specific classifier limit applicability in high-throughput NIDS settings. The baselines we compare against, and the design space in which BARS sits, are therefore filter methods. A consistent limitation of classical filters in the NIDS context is that they apply class-symmetric criteria: features are scored by how well they separate classes in general, without distinguishing which class defines normal behavior. This symmetry is misaligned with the operational structure of intrusion detection, where benign traffic is the reference distribution and attacks are characterized as deviations. The closest prior work in design space is Classwise Mean Deviation (CMD) [11], which scores features by class-conditional first moments rather than class-symmetric statistics, establishing that mean-shift signals can be both simple and competitive for NIDS feature ranking. CMD anchors its scoring to a global reference, however, which under class imbalance introduces the structural bias analyzed in Section 4.5. BARS retains the linear-time, parameterfree spirit of CMD but replaces the global anchor with the benign-class mean, directly addressing the class-symmetry limitation of both classical filters and CMD itself.
3.2. False Alarm Reduction in NIDS (1)
c=0
and retains the top-k features in descending order of (CMD) Dj . CMD is parameter-free, runs in O(N d) time, and reports competitive performance against classical filters such as Mutual Information and Fisher Score. The structural limitation of this formulation—that under class imbalance the global anchor is pulled toward, but does not coincide with, the benign mean—is the starting point for BARS and is analyzed in detail in Section 4.5.
3. Related Work We organize prior work into three areas relevant to this paper: feature selection for NIDS (including CMD, the closest prior method), false alarm reduction, and imbalanced learning.
Reducing false alarms is recognized as a central operational challenge in NIDS [1], [2]. Existing approaches fall broadly into three categories. Threshold tuning adjusts the classifier’s decision threshold to favor precision over recall, typically guided by ROC analysis [5]; this is effective but limited by the precision-recall trade-off of the underlying classifier. Anomaly detection models the benign distribution directly and labels deviations as attacks, with Isolation Forest [6] and One-Class SVM [7] as canonical examples; these can be deployed as standalone classifiers and avoid the need for labeled attack data, but typically incur higher FPR than supervised methods when attack labels are available. Costsensitive learning incorporates the operational asymmetry between false positives and false negatives into the training loss. These approaches share a structural property: they operate at or after the classifier, compensating for noise rather
than preventing it. BARS takes a complementary upstream approach by removing benign-variability features before the classifier sees them, addressing the root cause rather than the downstream symptom. The two families are not mutually exclusive—BARS can be combined with threshold tuning or cost-sensitive learning—but our experiments isolate the feature-selection contribution to allow a clean comparison.
3.3. Imbalanced Learning Class imbalance is a defining property of NIDS data: benign traffic typically dominates operational deployments, though published benchmarks span a range of imbalance regimes from benign-majority to attack-majority [2], [4]. Resampling methods such as SMOTE [17] synthesize minority-class samples to rebalance training distributions, and class-weighted loss functions assign higher importance to minority classes during optimization. Both approaches operate at the classifier-training stage and improve minorityclass recall, but they can introduce overfitting, syntheticdata artifacts, or unstable gradients, and they do not address feature-level noise within the benign class. BARS complements rather than replaces these methods: it operates at the feature selection stage, removes a different source of noise (benign-variability features), and can be composed with any imbalance-aware training procedure. Our experiments include SMOTE and class-weighted baselines specifically to demonstrate that BARS’s FPR reduction is not subsumed by existing imbalance-handling techniques.
3.4. Positioning Our work occupies a deliberately narrow design space: a parameter-free, classifier-agnostic, linear-time filter that explicitly targets false alarm reduction through semantic alignment with the operational structure of NIDS. To our knowledge, no prior feature selection method for NIDS combines all four of these properties. Filter methods (MI, Fisher, Pearson) are parameter-free and scalable but classsymmetric; imbalance-aware methods are class-asymmetric but operate at the classifier rather than the feature level; CMD is the closest prior work in design space but suffers from the global-anchor bias described in Section 4.5. BARS addresses this gap with a single, principled modification— benign anchoring—and we evaluate it against representatives of each adjacent family.
4. Methodology The proposed BARS method is a two-stage feature selection pipeline. Stage 1 ranks features by their absolute mean deviation from benign traffic—a benign-anchored refinement of Classwise Mean Deviation (CMD) [11]. Stage 2 walks the ranked list in order and prunes features that are highly correlated with previously selected features, ensuring that the k -feature budget is spent on a complementary subset rather than on near-duplicates.
4.1. Problem Setting Let D = {(xi , yi )}N i=1 denote a labeled network traffic dataset, where each sample xi ∈ Rd is a d-dimensional feature vector and yi ∈ {0, 1, . . . , C} is the corresponding class label. The label y = 0 denotes benign (normal) traffic, and labels y ∈ {1, . . . , C} correspond to C distinct attack classes. This formulation reflects the operational reality of NIDS, where benign traffic dominates and attacks are naturally defined as deviations from normal behavior. We assume features are real-valued and on a comparable scale; we describe the specific preprocessing used in our experiments in Section 5.
4.2. Stage 1: Benign-Anchored Ranking The core idea of Stage 1 is to quantify feature relevance by measuring the deviation of attack-class distributions relative to benign traffic along each feature dimension. Let µc ∈ Rd denote the mean vector of class c, computed over all samples with label y = c; in particular, µ0 denotes the benign-class mean. For each feature j ∈ {1, . . . , d}, the benign-anchored relevance score is Sj =
C X
|µc,j − µ0,j | .
(2)
c=1
This score accumulates the absolute deviation of each attack-class mean from the benign mean along feature j . Features with larger Sj exhibit stronger and more consistent deviations from normal behavior across attack classes and are therefore more informative for intrusion detection. The score is directly interpretable as a class-aggregated meanshift magnitude relative to benign behavior.
4.3. Stage 2: Order-Preserving Decorrelation The benign-anchored score Sj is univariate: it scores each feature independently without reference to other features. As a result, features that share an underlying signal— for example, correlated flow-level statistics derived from the same packet stream—receive similar scores and crowd the top-k selection with near-duplicates. This wastes the feature budget and, in our setting, can elevate FPR by amplifying the contribution of noisy feature clusters in the classifier input. To address this, BARS applies an order-preserving decorrelation step to the ranked feature list. Let R = (j1 , j2 , . . . , jd ) denote features sorted in descending order of Sj . Starting from an empty set S = ∅, we visit each j ∈ R in order and accept it if and only if its absolute Pearson correlation with every previously selected feature falls below a threshold τ : max |ρ(xj , xj ′ )| < τ. ′ j ∈S
(3)
The procedure stops when |S| = k or R is exhausted. If the decorrelation step yields fewer than k features, we backfill
with the next-best ranked features regardless of correlation, ensuring a fair fixed-budget comparison across methods. Two properties of this step are worth emphasizing. First, the procedure is order-preserving: it never reorders features by correlation, only filters out those redundant with higherranked predecessors. The top-ranked feature is always retained, the second-best is retained if not redundant with the first, and so on. Second, the threshold τ has a clear operational interpretation: τ = 1 disables the filter and recovers pure ranking, while τ close to 0 enforces nearorthogonality of the selected subset. Choice of τ .. The correlation threshold τ is the sole hyperparameter of BARS. We select τ from the candidate set {0.75, 0.85, 0.90, 0.95, 0.98} using a held-out validation split (disjoint from both training and test). Validation is performed at the largest feature budget considered in our study (k = 40): at smaller budgets, all feature-selection methods operate well below the dimensionality used by the non-selection baselines, which compresses the dynamic range of the comparison and makes the role of τ harder to read; at k = 40, the comparison stabilizes and the threshold’s effect is clearly resolved. The τ value selected on validation at k = 40 is then held fixed across all five feature budgets for that dataset. The selected values fall into two regimes. On the smaller benchmarks (NSL-KDD, d=41; UNSW-NB15, d=49), validation selects τ = 0.85: their feature spaces contain relatively few near-duplicates, and a permissive threshold retains moderately correlated but complementary signals. On the larger contemporary captures (CICIDS2017, CICDDoS2019, both d=88), τ = 0.98 is used, a value consistent with the high redundancy among flow-statistic features in these captures and confirmed by inspection of the empirical correlation structure. The candidate set is fixed in advance, τ is never tuned on the test set, the same procedure is applied uniformly across baselines and feature budgets, and a single τ value is committed per dataset. This protocol prevents per-budget cherry-picking while acknowledging the dependence of an optimal correlation threshold on feature-space structure.
4.5. Design Rationale Why a benign anchor.. The Stage 1 scoring function (Eq. 2) departs from CMD [11] in two related respects. Placed side by side, (CMD)
Dj
4.4. Algorithm and Complexity Algorithm 1 summarizes the full BARS procedure. Stage 1 (class-mean computation and scoring) is O(N d). Stage 2 computes the d × d Pearson correlation matrix from N samples in O(N d2 ), followed by a greedy walk in O(dk). The overall complexity is therefore O(N d + N d2 + dk) = O(N d2 ),
Algorithm 1 Benign-Anchored Ranking and Selection (BARS) Require: Preprocessed feature matrix X ∈ RN ×d , label vector y , feature budget k , correlation threshold τ (default τ = 0.98) Ensure: Selected feature subset S of size k 1: // Stage 1: Benign-anchored ranking 2: for c = 0 to C do 3: µc ← mean {xi : yi = c} 4: end for 5: for j = 1 to d do PC 6: Sj ← c=1 |µc,j − µ0,j | 7: end for 8: R ← feature indices sorted by Sj (descending) 9: // Stage 2: Order-preserving decorrelation 10: Compute correlation matrix R ∈ Rd×d with Rj,j ′ = ρ(xj , xj ′ ) 11: S ← ∅ 12: for each j ∈ R (in order) do 13: if S = ∅ or maxj ′ ∈S |Rj,j ′ | < τ then 14: S ← S ∪ {j} 15: end if 16: if |S| = k then 17: break 18: end if 19: end for 20: // Backfill if decorrelation yielded fewer than k features 21: if |S| < k then 22: Append next features from R \ S in rank order until |S| = k 23: end if 24: return S
(4)
dominated by the correlation pass. For typical NIDS feature dimensionalities (d ∈ [40, 90]), this is negligible relative to classifier training and well within real-time constraints on commodity hardware for measured runtime).
=
Sj =
C X c=0 C X
|µc,j − µglobal,j | ,
(5)
|µc,j − µ0,j | .
(6)
c=1
the two formulations differ in (i) the anchor point—the global mean µglobal in CMD, the benign-class mean µ0 in BARS—and (ii) the summation range, since the benign selfdeviation |µ0,j − µ0,j | = 0 drops out of Sj by construction. This asymmetry is operationally motivated. Under heavy class imbalance with benign prior π0 → 1, the global mean satisfies µglobal → µ0 and the two scores converge. Under moderate or evolving imbalance, however, the global mean is pulled toward attack distributions, shrinking the deviation |µc − µglobal | and underweighting precisely those features
that distinguish attacks from benign traffic. Benign anchoring eliminates this attack-induced shrinkage by construction, ensuring that feature relevance is measured against a stable reference rather than a class-mixed centroid that varies with the imbalance ratio. This aligns the scoring function with the operational definition of intrusion detection: deviation from normal behavior. Why two stages.. Stage 1 alone still selects redundant clusters of benign-anchored features whenever multiple flow statistics share an underlying signal; Stage 2 alone, applied to a class-symmetric filter, still inherits that filter’s mismatch with the operational structure of NIDS. BARS addresses both failure modes simultaneously, and our ablation in Section 6.6 confirms that the gains decompose as expected: benign anchoring contributes one share of the FPR reduction, decorrelation another, and the combination outperforms either in isolation.
5. Experimental Setup This section describes the datasets, preprocessing pipeline, baselines, evaluation metrics, and protocol used to assess BARS. All design choices are fixed across methods to ensure that observed performance differences are attributable to the feature selection strategy alone.
5.1. Datasets We evaluate BARS on three primary NIDS benchmarks: CICIDS2017 [18], CICDDoS2019 [19], and UNSWNB15 [20]. The three are chosen to span complementary evaluation regimes along two axes: contemporary versus legacy traffic, and a wide range of class-imbalance ratios in both directions. As Table 1 shows, CICIDS2017 is benignmajority (typical of operational network monitoring), CICDDoS2019 is extremely attack-majority (typical of curated DDoS-only captures), and UNSW-NB15 is moderately attack-majority. Evaluating across this imbalance spectrum is deliberate: it tests whether benign anchoring—which is motivated by the operational case where benign defines the baseline—remains effective when benign is itself the minority class in the training data. We discuss the implications of attack-majority training data for benign anchoring in Section 7. We additionally include NSL-KDD [21] as a legacy sanity-check dataset for comparability with prior NIDS feature-selection literature. NSL-KDD’s standard evaluation protocol yields a single test-set measurement per (method, k ) pair, which prevents the paired statistical testing used in our main analysis; we therefore report NSL-KDD results separately in Appendix A and do not include them in the main results tables. CICIDS2017. A modern, benign-majority benchmark with 88 flow-based features covering contemporary attack types including brute-force, infiltration, and denial-ofservice. Eleven classes total (1 benign, 10 attack). CICDDoS2019. A DDoS-focused capture with 88 features in which attacks dominate by more than two orders of
TABLE 1. P RIMARY DATASET STATISTICS AFTER PREPROCESSING . I MBALANCE RATIO IS REPORTED AS MAJORITY: MINORITY SAMPLE COUNTS ; THE MAJORITY CLASS COLUMN INDICATES WHICH CLASS DOMINATES . CICDD O S2019 USES THE STANDARD 20% DAY-1 SUBSET. NSL-KDD STATISTICS AND RESULTS ARE REPORTED IN A PPENDIX A.
Dataset CICIDS2017 CICDDoS2019 UNSW-NB15
# Feat.
# Benign
# Attack Majority
Ratio
88 2,203,723 469,274 Benign 88 9,206 3,407,109 Attack 49 56,000 119,341 Attack
4.70:1 370.1:1 2.13:1
magnitude. We use the 20% Day-1 subset and treat it as the extreme attack-majority regime, stress-testing the benignanchored design when benign training data is severely underrepresented. Eight classes (1 benign, 7 attack). UNSW-NB15. A modern dataset with 49 features and 10 classes (1 benign, 9 attack), exhibiting moderate attackmajority imbalance. Table 1 summarizes the three primary datasets after preprocessing.
5.2. Data Cleaning and Preprocessing All datasets are processed using a unified preprocessing pipeline applied identically to every method, so that performance differences reflect feature selection rather than data preparation. The pipeline proceeds in the following order. Sample-level cleaning.. Samples with excessive missing values are removed following the dataset-quality analyses of Lanvin et al. [22]. Remaining missing entries are imputed using feature-wise means computed on the training set only, to avoid leakage from the test set. Feature-level cleaning.. Application-dependent identifiers—including Source IP, Destination IP, Destination Port, Protocol, and Timestamp— are excluded prior to scoring. These fields encode dataset-specific deployment artifacts and can produce spurious near-perfect classification through information leakage. Categorical encoding.. Categorical attributes in NSLKDD and UNSW-NB15 are converted using one-hot encoding. CICIDS2017 and CICDDoS2019 contain no categorical features after the identifier-removal step in feature-level cleaning. Min–Max scaling.. All numerical features are scaled to the range [0, 1] using Min–Max normalization. Scaling parameters (per-feature min and max) are fit on the training set and applied unchanged to the test set. Low-variance filtering.. After scaling, we remove features whose empirical variance falls below a threshold ϵ: Var(xj ) < ϵ, (7) with ϵ = 10−4 . Because filtering is applied after Min–Max scaling, the threshold has a uniform interpretation across features and datasets: a feature is dropped only if its variation across samples spans less than 1% of its observed range.
The filter is applied identically to every method we evaluate and is therefore part of the data preparation pipeline rather than a competing feature selection baseline; it operates as a noise-reduction stage prior to any discriminative scoring.
5.3. Baseline Methods We compare BARS against a diverse set of baselines spanning classical feature selection, imbalance-aware training procedures, threshold-based methods, and anomaly detection. 5.3.1. Feature Selection Baselines. We consider widely used filter-based feature selection methods, which share BARS’s design space (univariate, classifier-agnostic, computationally efficient) and constitute the most direct comparisons. Pearson Correlation. Features are ranked by their absolute linear correlation with the class label [9]. Mutual Information (MI). MI measures the statistical dependency between features and class labels, capturing both linear and nonlinear relationships [8], [12]; features with higher MI scores are retained. Fisher Score. Fisher Score ranks features by the ratio of inter-class separation to intra-class variance [10], favoring features that maximally distinguish classes. Classwise Mean Deviation (CMD). CMD computes feature relevance by aggregating absolute deviations of class-wise means from a global reference mean [11]. As the direct predecessor of BARS, CMD serves as the most informative head-to-head baseline. 5.3.2. Imbalance-Aware Training Procedures. Classweighted learning and SMOTE are not feature-selection methods; they are classifier-stage interventions that target the same operational problem (imbalance-induced bias) from a different point in the pipeline. We include them not as competing feature selectors but to verify that BARS’s FPR reduction is not subsumed by these techniques when applied to the same baseline filters. Class-Weighted Learning. The classifier loss is reweighted so that minority classes contribute proportionally more to gradient updates [4]. SMOTE. Synthetic Minority Over-sampling Technique generates synthetic minority-class samples to rebalance training distributions prior to classifier training [17]. 5.3.3. Threshold-Based Baselines. Because false alarms are strongly affected by decision thresholds, we evaluate two threshold strategies on top of an otherwise unmodified classifier: Default Threshold. Classification decisions use the standard probability threshold of 0.5. Optimized Threshold. The decision threshold is selected on validation data to maximize Youden’s J statistic (TPR − FPR), following standard ROC analysis [5]. These baselines characterize what is achievable through post-hoc decision tuning alone and are orthogonal to feature
selection; they are included to show that BARS’s contribution is not subsumed by threshold optimization. 5.3.4. Anomaly Detection Baselines. To assess robustness under different modeling assumptions, we include two anomaly detection methods deployed as standalone classifiers that model benign traffic directly and flag deviations as attacks: Isolation Forest. An unsupervised anomaly detection method that isolates anomalous samples through random partitioning [6]. One-Class SVM. A one-class classification approach that models the benign distribution and identifies deviations as anomalies [7]. All baselines share the unified preprocessing pipeline of Section 5.2 and, where applicable, the downstream classifier described in Section 5.5. Feature selection baselines are evaluated at the same set of feature budgets as BARS; the remaining baselines use standard configurations from their respective references.
5.4. Evaluation Metrics We evaluate model performance using metrics that capture both detection capability and false alarm behavior. The primary metric of interest is the False Positive Rate (FPR): FPR =
FP , FP + TN
(8)
where FP and TN denote false positives and true negatives. FPR directly measures the frequency at which benign traffic is incorrectly classified as malicious and is the primary operational concern motivating this work. We additionally report the True Positive Rate (TPR): TPR =
TP , TP + FN
(9)
which captures the model’s ability to correctly detect attack instances, and Macro-averaged F1-score (Macro-F1), which provides a balanced evaluation across all classes and ensures that minority attack classes are not overshadowed by the dominant benign class.
5.5. Experimental Protocol To isolate the effect of feature selection on false alarm reduction, all experiments use a fixed downstream classifier. We employ a Multi-Layer Perceptron (MLP) with three hidden layers of sizes {64, 128, 64}, trained using the Adam optimizer with a learning rate of 10−3 . The MLP is used as a generic supervised classifier rather than for any architecturespecific advantage. Feature budgets.. Feature selection methods are evaluated at feature budgets k ∈ {5, 10, 20, 30, 40}, covering both highly constrained and moderately constrained settings. For each k , the top-k ranked features are selected and used for classification.
Train-test splits.. For datasets with predefined traintest splits (NSL-KDD, UNSW-NB15), we use the original partitions. For datasets without standard splits (CICIDS2017, CICDDoS2019), we apply an 80:20 stratified train-test split and perform 5-fold cross-validation on the training portion. Identical splits and folds are used across all methods to ensure fair comparison. Statistical significance.. For the direct BARS-vsCMD comparison, we report mean and standard deviation across folds (for CICIDS2017 and CICDDoS2019) or across repeated runs with randomized classifier initialization (for NSL-KDD and UNSW-NB15, where standard splits preclude resampling). Significance is assessed using a paired Wilcoxon signed-rank test with α = 0.05; the non-parametric paired test is chosen because it requires no normality assumption and accounts for the pairing of measurements across folds or runs. We note that the variance source differs between dataset groups (fold variance vs. initialization variance), and we interpret cross-dataset significance accordingly. Reproducibility.. All preprocessing steps, classifier settings, and evaluation protocols are fixed and identical across methods. Random seeds are fixed for data splitting, classifier initialization, and SMOTE oversampling. The only hyperparameter selected per method-and-dataset combination is BARS’s correlation threshold τ , chosen on a held-out validation split as described in Section 4.3; all baseline methods use their standard configurations. Code, configurations, and seed values will be released to support reproducibility and ACSAC artifact evaluation.
6. Results We evaluate BARS against the baselines described in Section 5.3 on three benchmark datasets that span the imbalance spectrum: CICIDS2017 (benign-majority, 4.7:1), UNSW-NB15 (attack-majority, 2.1:1), and CICDDoS2019 (extreme attack-majority, 370:1). NSL-KDD results are reported in Appendix A; the standard NSL-KDD evaluation protocol yields a single test-set measurement per (method, k ) pair, which prevents the paired statistical testing used in our main analysis.
6.1. Research Questions The design rationale of BARS (Section 4.5) predicts that benign anchoring should help most in attack-majority regimes, where the global mean used by CMD is pulled away from the benign baseline. We organize the evaluation around three questions: RQ1
RQ2
Does BARS reduce false positive rate relative to CMD in attack-majority regimes, where the global-anchor bias is expected to be most severe? Does any FPR reduction preserve detection capability (TPR, Macro-F1)?
RQ3
How does the BARS–CMD gap vary with imbalance direction and feature budget?
We additionally compare BARS against classical filter baselines and classifier-stage interventions to position the contribution within the broader feature-selection landscape, and compare the unnormalized BARS score against a benignspread normalized variant (Section 6.6).
6.2. Main Results at k = 20 (RQ1, RQ2) Table 2 reports FPR, TPR, and Macro-F1 at the representative feature budget k = 20 across the three primary datasets. We organize the comparison around the head-tohead with CMD (the most direct comparison, since BARS and CMD differ only in the anchor point of the deviation score) and report classical filters, classifier-stage interventions, and anomaly detection baselines for context. Head-to-head with CMD (RQ1).. On the attackmajority UNSW-NB15 dataset, BARS reduces FPR from 0.380 (CMD) to 0.322—a relative reduction of 15.4%— while preserving F1 within 0.007 and TPR within 0.022 of CMD. On the extreme attack-majority CICDDoS2019 dataset, BARS and CMD are tied at k = 20 (0.029 vs 0.029), but the picture changes substantially at lower budgets, where BARS’s advantage is most pronounced (Section 6.3). On the benign-majority CICIDS2017 dataset, BARS slightly underperforms CMD at k = 20 (0.026 vs 0.024), consistent with the design rationale of Section 4.5: when benign traffic dominates, the global mean closely approximates the benign mean and the two scoring functions converge. Detection capability (RQ2).. BARS preserves detection capability across all three datasets. TPR remains above 0.97 on the attack-dominant datasets (CICDDoS2019: 1.000; UNSW-NB15: 0.971) and improves over CMD on CICIDS2017 (0.901 vs 0.867). Macro-F1 is comparable to or higher than CMD on all three datasets (CICIDS2017: 0.726 vs 0.699; CICDDoS2019: 0.726 vs 0.728; UNSWNB15: 0.326 vs 0.320). The FPR reduction on UNSW-NB15 therefore reflects a genuine improvement, not a degraded benign-prediction collapse. Position in the broader landscape.. A complete reading of Table 2 requires acknowledging that the lowest FPR on each dataset is not always achieved by BARS. On CICIDS2017, Mutual Information reaches FPR=0.014 at k = 20, outperforming both BARS (0.026) and CMD (0.024); the threshold-default baseline reaches FPR=0.018. On CICDDoS2019, threshold optimization reaches FPR=0.003 by exploiting the highly separable score distribution induced by the extreme imbalance, and Pearson correlation reaches FPR=0.019. On UNSW-NB15, threshold optimization (0.218) and Pearson (0.217) are essentially tied as the strongest methods, with Fisher score (0.381) close to CMD. We do not claim BARS to be the strongest feature selection method in absolute terms; we claim it is a principled and empirically better refinement of CMD specifically, with the advantage materializing precisely where the design rationale predicts. We note further that Fisher score and Mutual
TABLE 2. M AIN RESULTS AT FEATURE BUDGET k = 20. CV FOLDS FOR CICIDS2017 AND CICDD O S2019; SINGLE TEST- SET EVALUATION FOR UNSW-NB15. L OWEST FPR PER DATASET IS IN BOLD . ↓/↑ INDICATE LOWER / HIGHER IS BETTER . “—” INDICATES THE METHOD COULD NOT BE EVALUATED WITHIN AVAILABLE MEMORY; SEE S ECTION 5.3.
CICIDS2017 F1↑
CICDDoS2019 FPR↓ TPR↑
F1↑
UNSW-NB15
Category
Method
FPR↓ TPR↑
FPR↓ TPR↑
F1↑
Filter
Pearson MI Fisher
0.027 0.782 0.688 0.019 1.000 0.728 0.217 0.951 0.328 0.014 0.876 0.726 — — — 0.332 0.976 0.338 — — — — — — 0.381 0.993 0.317
Imbalance
SMOTE 0.064 0.999 0.792 0.004 1.000 0.681 0.421 0.999 0.423 Class-Weight 0.157 0.998 0.559 0.004 1.000 0.710 0.420 0.999 0.372
Threshold
Default (0.5) Optimized
0.018 0.897 0.764 0.039 1.000 0.729 0.282 0.976 0.361 0.041 0.951 0.719 0.003 1.000 0.728 0.218 0.957 0.362
Anomaly
IsoForest OC-SVM
0.050 0.354 0.083 0.051 0.377 0.050 0.077 0.306 0.067 0.050 0.344 0.083 0.047 0.669 0.032 0.062 0.656 0.083
Ours
CMD [11] BARS
0.024 0.867 0.699 0.029 1.000 0.728 0.380 0.993 0.320 0.026 0.901 0.726 0.029 1.000 0.726 0.322 0.971 0.326
TABLE 3. L OW- BUDGET FPR COMPARISON (k = 5, 10). BARS–CMD GAP IS LARGEST ON ATTACK - MAJORITY DATASETS AT THE SMALLEST BUDGET. R ELATIVE REDUCTION IS COMPUTED AS (CMD − BARS)/CMD. “—” INDICATES THE METHOD COULD NOT BE EVALUATED WITHIN AVAILABLE MEMORY.
k=5
k = 10
Dataset
Method
FPR
vs CMD
FPR
vs CMD
CICIDS2017
CMD BARS MI
0.035 0.034 0.036
— +1.4%
0.024 0.027 0.021
— −13.1%
CMD 0.063 — 0.066 — CICDDoS2019 BARS 0.048 +23.3% 0.052 +21.2% Pearson 0.422 0.057 UNSW-NB15
CMD BARS MI
0.519 0.422 0.185
— +18.7%
0.422 0.422 0.307
— 0.0%
Information exceeded available memory on the larger CIC datasets (Section 5.3), reinforcing the value of computationally inexpensive filters in high-throughput settings.
6.3. Low-Budget Regime (RQ3) The BARS–CMD gap is most pronounced at small feature budgets on attack-majority data. Table 3 reports FPR at k ∈ {5, 10} for BARS, CMD, and the strongest filter baseline on each dataset. Two patterns emerge from Table 3. First, on the two attack-majority datasets, BARS reduces FPR over CMD by 19–23% at k = 5 and by up to 21% at k = 10. This regime—small feature budgets on attack-dominant traffic— is exactly where the global anchor’s bias is theoretically most damaging: CMD must select few features under a scoring function whose global reference is severely pulled toward attack distributions, and benign anchoring corrects this. Second, on benign-majority CICIDS2017, the BARS–
Figure 1. FPR as a function of feature budget k for BARS, CMD, and the strongest filter baseline on each dataset. BARS–CMD gap narrows with increasing budget.
CMD gap is small in both directions, consistent with the (CMD) convergence of Sj and Dj in the π0 → 1 limit.
6.4. Sensitivity to Feature Budget Figure 1 reports FPR as a function of feature budget k ∈ {5, 10, 20, 30, 40} for BARS, CMD, and the strongest filter baseline on each dataset. The BARS–CMD gap narrows as k grows on both attack-majority datasets: at k = 40, BARS and CMD converge to within 0.005 FPR on UNSWNB15 and within 0.002 on CICDDoS2019. This convergence is structural: as the feature budget approaches the full dimensionality, the choice of which subset to retain matters less than the size of the subset itself, and benign anchoring’s selection advantage attenuates.
6.5. Statistical Significance We assess significance of the BARS–CMD difference using a paired Wilcoxon signed-rank test on per-fold FPR measurements for CICIDS2017 and CICDDoS2019, where 5-fold cross-validation provides paired observations. With only five paired measurements per (dataset, k ), the test is conservatively powered; no individual (dataset, k ) comparison reaches significance at α = 0.05 (Table 4), though
TABLE 4. PAIRED W ILCOXON SIGNED - RANK TEST ON PER - FOLD FPR (CICIDS2017, CICDD O S2019), BARS VS CMD. n = 5 PAIRED MEASUREMENTS PER ROW. N EGATIVE RELATIVE REDUCTION INDICATES BARS HIGHER THAN CMD.
Dataset
k
CMD FPR
BARS FPR
Rel. Red. (%)
CICIDS2017 CICIDS2017 CICIDS2017 CICIDS2017 CICIDS2017 CICDDoS2019 CICDDoS2019 CICDDoS2019 CICDDoS2019 CICDDoS2019
5 10 20 30 40 5 10 20 30 40
0.035 0.024 0.024 0.025 0.018 0.063 0.066 0.029 0.038 0.025
0.034 0.027 0.026 0.026 0.016 0.048 0.052 0.029 0.049 0.027
+1.4 −13.1 −6.0 −3.2 +9.4 +23.3 +21.2 −2.3 −29.6 −5.2
the directional pattern on CICDDoS2019 at small budgets is consistent with the per-fold means reported above. For UNSW-NB15, standard splits yield a single test-set measurement per (method, k ) and paired testing is not applicable; we report effect sizes only. A more powered evaluation —e.g., multi-seed resampling on the predefined-split datasets—is a clear next step.
TABLE 5. BARS VS BARS- NORM AT k = 20. BARS- NORM ACHIEVES ANOMALOUSLY LOW FPR ON UNSW-NB15 BUT AT THE COST OF CATASTROPHIC RECALL , INDICATING COLLAPSE TO A NEAR - TRIVIAL BENIGN - PREDICTOR .
Dataset
Variant
FPR↓
TPR↑
F1↑
CICIDS2017
BARS BARS-norm
0.026 0.014
0.901 0.700
0.726 0.580
CICDDoS2019
BARS BARS-norm
0.029 0.048
1.000 0.999
0.726 0.717
UNSW-NB15
BARS BARS-norm
0.322 0.000
0.971 0.104
0.326 0.086
ized score Sj is more robust and remains parameter-light, supporting our choice of Sj as the primary method.
6.7. Summary of Findings Our experiments support the following claims, scoped tightly to what the data shows: 1)
6.6. Scoring-Variant Comparison: BARS vs BARSnorm RQ4. Does benign-spread normalization improve over the simpler unnormalized score? A natural extension of the unnormalized BARS score is to divide each class deviation by the benign-class spread, emphasizing shifts that are large relative to natural benign variability: C X |µc,j − µ0,j | norm Sj = , (10) σ0,j + δ c=1 where σ0,j is the empirical benign standard deviation of feature j and δ = 10−6 is a stability constant. We refer to the resulting variant as BARS-norm. While theoretically well motivated, normalization introduces one additional hyperparameter (δ ) and a sensitivity to the estimation of σ0,j on features with concentrated benign distributions. Table 5 compares BARS and BARS-norm at k = 20 on the three primary datasets. The pattern is consistent across datasets: normalization either degrades performance (CICDDoS2019, where FPR rises from 0.029 to 0.048) or improves FPR at the cost of detection capability (CICIDS2017, where FPR drops to 0.014 but TPR collapses from 0.901 to 0.700). The UNSWNB15 result makes the failure mode explicit: BARS-norm achieves FPR=0.000 but TPR=0.104 and Macro-F1=0.086, i.e., the model predicts almost every flow as benign. We attribute this collapse to numerical instability in the benignspread denominator on features with concentrated benign distributions, which inflates Sjnorm for low-spread features that are not necessarily attack-discriminative. The unnormal-
2)
3)
BARS refines CMD in attack-majority regimes (RQ1). On UNSW-NB15 (k = 20), BARS reduces FPR by 15.4% over CMD; on CICDDoS2019 at small budgets (k = 5, 10), BARS reduces FPR by 21–23%. On benign-majority CICIDS2017, BARS and CMD are statistically indistinguishable, consistent with the predicted convergence in the π0 → 1 limit. FPR reduction preserves detection (RQ2). TPR remains above 0.97 on attack-dominant datasets and improves over CMD on CICIDS2017; MacroF1 is comparable or better than CMD on all three datasets. The BARS–CMD gap narrows with feature budget (RQ3). The advantage is largest at small k on attack-majority data and converges to near-zero at k = 40, structurally consistent with the diminishing role of feature selection as the budget approaches full dimensionality.
We emphasize the boundaries of these claims. BARS does not universally outperform classical filter baselines: Pearson correlation and Mutual Information achieve lower FPR than BARS on several (dataset, k ) combinations, and threshold optimization is the strongest single FPR-reduction method on the attack-majority datasets. Our contribution is methodological: BARS identifies and corrects a specific structural bias in its direct predecessor CMD, with measurable improvements in the regime where the bias is most severe. A more powered statistical evaluation, and combinations of BARS with classifier-stage interventions, are clear directions for future work.
7. Discussion When benign anchoring helps.. The regime-specific pattern in Section 6 matches the design rationale precisely.
CMD’s global anchor is a frequency-weighted average of class means; as the benign prior π0 departs from one, the anchor drifts toward attack distributions and attack-class deviations are systematically attenuated. Benign anchoring removes the attenuation by construction, so attack-class deviations are scored at full magnitude regardless of trainingtime class composition. The practical implication: BARS should be preferred over CMD whenever the training-time benign prior is uncertain or moderate; the two methods are operationally indistinguishable when benign traffic dominates the training corpus. Why BARS is not the strongest filter everywhere.. Pearson correlation and Mutual Information frequently achieve lower FPR than BARS. We attribute this to BARS’s reliance on first-moment scoring: two distributions can share a mean but differ in variance, modes, or higher moments, and a mean-deviation score is blind to such differences. Richer scoring functions capture more of the joint distribution but scale unfavorably—Fisher Score and MI exceeded 1 TB of memory on the larger CIC datasets in our evaluation. BARS’s contribution is therefore best understood as the principled choice within the mean-deviation family, which remains operationally relevant where richer methods cannot run. Adaptive adversaries.. Our threat model assumes a non-adaptive adversary. An adaptive adversary aware of BARS could attempt to craft traffic close to µ0 along selected features, but this requires either model compromise (excluded) or detectable black-box probing, and severely constrains the space of viable attack payloads—particularly for attacks whose semantics inherently deviate from benign (e.g., volumetric DDoS). Mimicry attacks against featurebased NIDS affect all selection methods and are orthogonal future work. Limitations.. Three limitations bound our claims. Statistical power is the most important: with five paired CV folds per cell, no individual BARS–CMD comparison reaches α = 0.05, and UNSW-NB15 admits no paired testing at all under the standard split. First-moment scoring limits the distributional differences BARS can capture, as discussed above. Stationarity is assumed throughout; behavior under concept drift is unevaluated. Multi-seed resampling and combinations of BARS with classifier-stage interventions are clear next steps. Deployment.. BARS requires only labeled training data, produces a fixed feature projection at inference, and integrates with any standard NIDS toolchain. Memory is dominated by the O(d2 ) correlation matrix—tens of kilobytes for typical NIDS dimensionalities, and independent of dataset size. Scores are directly interpretable as attack-class mean shifts from benign, supporting analyst sanity checks against domain knowledge.
8. Conclusion We introduced Benign-Anchored Ranking and Selection (BARS), a two-stage feature selection method that addresses a structural bias in the global-anchored scoring of its direct
predecessor, Classwise Mean Deviation (CMD). Under class imbalance, CMD’s global anchor drifts toward attack distributions and systematically attenuates class-deviation scores; BARS replaces it with the benign-class mean, eliminating the attenuation by construction, and follows the score with an order-preserving decorrelation step. Across three NIDS benchmarks spanning the imbalance spectrum, the empirical pattern matches the design rationale. On attack-majority data, BARS reduces FPR over CMD by 15.4% on UNSW-NB15 at k = 20 and by 21–23% on CICDDoS2019 at small budgets, while preserving TPR and Macro-F1. On benign-majority CICIDS2017, BARS and CMD are statistically indistinguishable, consistent with the theoretical convergence of the two scores in the π0 → 1 limit. We position BARS narrowly. It is a principled refinement of CMD specifically, not a universally dominant filter: classical methods with richer scoring functions (Pearson, MI) achieve lower FPR on several settings, and threshold optimization remains the strongest single FPR-reduction lever on attack-majority data. BARS’s value lies in its linear-time scoring, low memory footprint, and direct interpretability— properties most useful in deployments where richer methods cannot run, as evidenced by Fisher and MI exceeding 1 TB of memory on the larger CIC datasets in our evaluation. Future work includes more powered statistical evaluation, composition with classifier-stage interventions, and extensions of the mean-deviation family beyond first moments.
References [1]
R. Sommer and V. Paxson, “Outside the closed world: On using machine learning for network intrusion detection,” in IEEE Symposium on Security and Privacy, 2010.
[2]
A. L. Buczak and E. Guven, “A survey of data mining and machine learning methods for cyber security intrusion detection,” IEEE Communications Surveys & Tutorials, 2016.
[3]
M. Ring, S. Wunderlich, D. Gründl, D. Landes, and A. Hotho, “A survey of network-based intrusion detection data sets,” Computers & Security, 2019.
[4]
H. He and E. A. Garcia, “Learning from imbalanced data,” IEEE Transactions on Knowledge and Data Engineering, vol. 21, no. 9, pp. 1263–1284, 2009.
[5]
T. Fawcett, “An introduction to roc analysis,” Pattern Recognition Letters, vol. 27, no. 8, pp. 861–874, 2006.
[6]
F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” in Proceedings of the 8th IEEE International Conference on Data Mining (ICDM), 2008, pp. 413–422.
[7]
B. Schölkopf, J. C. Platt, J. Shawe-Taylor, A. J. Smola, and R. C. Williamson, “Estimating the support of a high-dimensional distribution,” Neural Computation, vol. 13, no. 7, pp. 1443–1471, 2001.
[8]
J. R. Vergara and P. A. Estévez, “A review of feature selection methods based on mutual information,” Neural Computing and Applications, vol. 24, pp. 175–186, 2014.
[9]
I. M. Nasir, M. A. Khan, M. Yasmin, J. H. Shah, M. Gabryel, R. Scherer, and R. Damaševičius, “Pearson correlation-based feature selection for document classification using balanced training,” Sensors, vol. 20, no. 23, p. 6793, 2020. [Online]. Available: https://www.mdpi.com/1424-8220/20/23/6793
[10] Q. Gu, Z. Li, and J. Han, “Generalized fisher score for feature selection,” arXiv preprint arXiv:1202.3725, 2012.
1. Dataset and Protocol
[11] A. F. Ahmad, J. Liu, Q. Gong, S. Misra, and J. Harikumar, “Feature selection via class-wise mean deviation,” in 2025 International Conference on Machine Learning and Applications (ICMLA), 2025, pp. 698–703.
NSL-KDD is a refined version of the KDD Cup 1999 dataset with duplicate records removed and the train/test partitions held fixed across studies. We use the standard 20% training subset and the canonical test split, with 41 features (numerical and one-hot encoded categorical) and 20 classes (1 benign, 19 attack across the DoS, Probe, R2L, and U2R families). After preprocessing (Section 5.2), the dataset contains 13,449 benign and 11,561 attack samples—a nearbalanced regime (1.16:1 benign-majority) and the smallest of the four benchmarks considered in this work.
[12] M. Beraha, A. M. Metelli, M. Papini, A. Tirinzoni, and M. Restelli, “Feature selection via mutual information: New theoretical insights,” arXiv preprint arXiv:1907.07384, 2019. [13] Scikit-learn, “Variancethreshold — scikit-learn 1.7.0 documentation,” 2025, https://scikit-learn.org/stable/modules/generated/sklearn. feature selection.VarianceThreshold.html. [14] J. Li, K. Cheng, S. Wang, F. Morstatter, R. P. Trevino, J. Tang, and H. Liu, “Feature selection: A data perspective,” ACM Computing Surveys (CSUR), vol. 50, no. 6, p. 94, 2018. [15] V. Bolón-Canedo, D. Rego-Fernández, D. Peteiro-Barral, A. AlonsoBetanzos, B. Guijarro-Berdiñas, and N. Sánchez-Maroño, “On the scalability of feature selection methods on high-dimensional data,” Knowledge and Information Systems, vol. 56, pp. 395–442, 2018. [Online]. Available: https://link.springer.com/article/10.1007/ s10115-017-1140-3 [16] C. Westphal, S. Hailes, and M. Musolesi, “Feature selection for network intrusion detection,” in Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.1, ser. KDD ’25. Association for Computing Machinery, 2025, p. 1599–1610. [Online]. Available: https://doi.org/10.1145/3690624. 3709339
2. Why NSL-KDD Is Reported Separately The standard NSL-KDD protocol provides a single predefined test set and no canonical splitting strategy for crossvalidation. Our evaluation therefore produces one test-set measurement per (method, k ) pair, in contrast to the five per-fold measurements available on CICIDS2017 and CICDDoS2019. This has two consequences: •
[17] N. V. Chawla, K. W. Bowyer, L. O. Hall, and W. P. Kegelmeyer, “Smote: Synthetic minority over-sampling technique,” Journal of Artificial Intelligence Research, vol. 16, pp. 321–357, 2002. [18] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in International Conference on Information Systems Security and Privacy, 2018, canadian Institute for Cybersecurity. [Online]. Available: https://api.semanticscholar.org/ CorpusID:4707749 [19] I. Sharafaldin, A. Habibi Lashkari, I. Sahib, and A. Ghorbani, “Developing realistic distributed denial of service (ddos) attack dataset and taxonomy,” in IEEE 53rd International Carnahan Conference on Security Technology, Chennai, India., 10 2019, pp. 1–8, canadian Institute for Cybersecurity. [20] H. Mohammadian, A. Habibi Lashkari, and A. Ghorbani, “Poisoning and evasion: Deep learning-based nids under adversarial attacks,” in 21st Annual International Conference on Privacy, Security and Trust (PST), 08 2024, pp. 1–9. [21] M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, “A detailed analysis of the kdd cup 99 data set,” in 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, 2009, pp. 1–6. [22] M. Lanvin, P.-F. Gimenez, Y. Han, F. Majorczyk, L. Mé, and E. Totel, “Errors in the cicids2017 dataset and the significant differences in detection performances it makes,” in International Conference on Risks and Security of Internet and Systems (CRiSIS). Springer, 2023, pp. 18–33.
Appendix This appendix reports the full BARS evaluation on NSLKDD [21], separated from the main results (Section 6) for methodological reasons explained below. We summarize the dataset, the evaluation limitation that motivates its appendixonly treatment, the per-method numbers, and a brief reading of what the results do and do not show.
•
The paired Wilcoxon signed-rank test used in Section 6.5 is uninformative on NSL-KDD: with n = 1 paired observation, the test statistic is bounded such that no p-value below 0.5 is achievable regardless of effect magnitude. We omit NSL-KDD from Table 4 for this reason. Single-measurement comparisons are not robust to classifier-initialization variance. Apparent FPR differences of tens of percent between methods at adjacent feature budgets may reflect run-to-run noise rather than method differences, and cannot be distinguished without resampling.
We report NSL-KDD here for completeness and comparability with prior NIDS feature-selection literature, but we do not draw method-level conclusions from these results in the main paper.
3. Per-Method Results Table 6 reports FPR, TPR, and Macro-F1 for all filterbased methods on NSL-KDD across the five feature budgets.
4. Reading the Results The BARS–CMD comparison on NSL-KDD exhibits wide and inconsistent swings across budgets: BARS reduces FPR by 48.6% at k = 10 and 55.3% at k = 20, but increases FPR by 45.1% at k = 5 and 172.7% at k = 40. With only one measurement per cell, we cannot attribute these swings to genuine method differences rather than to run-to-run variance from the underlying MLP classifier’s initialization. The behavior of Fisher score and Pearson on the same dataset shows similar instability (Fisher FPR ranging from 0.017 at k = 5 to 0.067 at k = 30), reinforcing that the variance source is the evaluation protocol rather than any particular method.
TABLE 6. NSL-KDD: FILTER METHODS ACROSS FEATURE BUDGETS . S INGLE TEST- SET MEASUREMENT PER CELL . T HE WIDE BUDGET- TO - BUDGET SWINGS ON SOME METHODS ILLUSTRATE THE RUN - TO - RUN VARIANCE THAT MOTIVATES APPENDIX - ONLY REPORTING .
Metric Method
k=5
k=10 k=20 k=30 k=40
FPR↓
Pearson MI Fisher CMD BARS
0.032 0.062 0.017 0.064 0.092
0.070 0.061 0.025 0.046 0.024
0.067 0.062 0.022 0.070 0.031
0.070 0.068 0.067 0.070 0.069
0.024 0.029 0.024 0.025 0.068
TPR↑
Pearson MI Fisher CMD BARS
0.670 0.650 0.678 0.707 0.755
0.702 0.650 0.699 0.705 0.696
0.736 0.701 0.712 0.706 0.699
0.709 0.697 0.701 0.699 0.697
0.702 0.706 0.707 0.702 0.710
F1↑
Pearson MI Fisher CMD BARS
0.154 0.175 0.239 0.206 0.157
0.211 0.261 0.303 0.228 0.213
0.273 0.264 0.376 0.298 0.316
0.332 0.300 0.338 0.311 0.312
0.361 0.343 0.351 0.364 0.344
We note one observation that does emerge robustly: BARS preserves TPR on NSL-KDD (range 0.696–0.755) at levels comparable to CMD (0.699–0.707) and the other filters. The detection-capability claim that holds on the three primary datasets also holds on NSL-KDD, even though FPR comparisons cannot be made reliably at the single-run level. A more powered NSL-KDD evaluation—multi-seed runs over randomized classifier initialization—is a clear next step. We chose not to include such results in this paper to maintain a uniform evaluation protocol across datasets (CICIDS2017 and CICDDoS2019 are evaluated via per-fold variance, not per-seed), but it is a natural follow-up for future work on benign-anchored feature selection.