Improving Network Anomaly Detection via Choquet-Integral-Based Feature Aggregation Abreu Quevedo∗ , Roger Immich† , Giancarlo Lucca∗ , Graçaliz Dimuro∗ , Bruno L. Dalmazo∗ ∗ Federal University of Rio Grande - FURG, Brazil † Federal University of Rio Grande do Norte - UFRN, Brazil
Abstract—This work investigates a generalized Choquetintegral-based feature aggregation framework to improve anomaly detection in high-dimensional network traffic data. The approach combines adaptive weighting with incremental feature selection to address feature redundancy. Using Random Forest and XGBoost classifiers, we evaluate models trained with both raw and Choquet-aggregated features under varying feature subset sizes. The proposed aggregation achieves up to 7% higher accuracy while reducing data volume by 77.5% (from 214 MB to 48 MB), without degrading precision and recall. Results averaged over multiple stratified repetitions indicate that Choquet-based aggregation yields statistically significant gains (p < 0.05) in scenarios with limited feature availability, highlighting its suitability for real-time intrusion detection under bandwidth and featureavailability constraints. Index Terms—Choquet Integral, Feature Engineering, Anomaly detection, Fuzzy.
increasingly powerful and large-scale over time. Some examples of the magnitude of these attacks were highlighted in 2025, when Cloudflare mitigated a record breaking distributed denial-of-service (DDoS) attack that peaked at 29,7 Tbps [5]. Such events illustrate the unprecedented scale of modern DDoS threats and how it reinforces the urgency of improving anomaly detection methods, particularly to safeguard the critical communication backbones of modern Smart Cities. In 2024, Cloudflare’s autonomous DDoS defense systems blocked approximately 21.3 million DDoS attacks, marking a 53% increase compared to 2023, on average, the company mitigated 4870 DDoS attacks per hour throughout the year and in the same year the company reported an expressive 1885% increase in the number of attacks above 1 Tbps in the last quarter of 2024, highlighting the severity and timeliness of this threat. A notable case in this context was the massive cyberattack against Elon Musk’s platform X, attributed to the hacker group Dark Storm, which caused a large-scale outage in March 2025 [6]. Considering the importance of defending large-scale data traffic, as previously mentioned, the Choquet integral [7]– [10] has emerged as a promising alternative across several data-intensive domains. In this sense, recent studies [3], [11], [12] have demonstrated its effectiveness in mitigating networkbased attacks, highlighting its potential to enhance the robustness and adaptability of anomaly detection systems. Following this perspective, we investigated how integrating fuzzy aggregation mechanisms, such as the Choquet integral, can favor a more expressive representation of inter-feature dependencies. This capability enables models to capture subtle correlations often overlooked by traditional techniques, contributing to a more accurate and resilient defense against evolving cyber threats. This study analyzes feature aggregation using feature engineering based on the generalized Choquet integral. The experiment incrementally increases the number of features to observe the classification model’s performance. Each setup is evaluated in two conditions: with features aggregated via the generalized Choquet integral and without aggregation. Random Forest and XGBoost are used to compare scenarios, assessing the impact of Choquet-based feature fusion on accuracy, precision, recall, and F1-score. This evaluation clarifies how fuzzy aggregation influences model performance as the feature space grows. The rest of this paper is structured as follows. Section 2 re-
M AC A C N E U P SC TE RI D PT
arXiv:2607.15389v1 [cs.CR] 16 Jul 2026
E-mail: {abreu rg, giancarlo.lucca, gracalizdimuro, dalmazo}@furg.br, [email protected]
I. I NTRODUCTION
In recent decades, distributed computing infrastructures have been the cornerstone of human development, especially in the field of communication. Every day, we become more accustomed to dealing with increasingly complex network patterns that continue to grow over time. Considering the current society in which we live, where a significant portion of humanity constantly generates data, depending on network management, IoT services [1] and communication within Smart City ecosystems, there is an increasing dependence on ensuring the reliability of this information. This context highlights critical aspects related to its vulnerability [2] and security [3] within contemporary digital networks. In this context, the massive flow of information in urban environments plays a crucial role not only in communication but also in maintaining security. Nevertheless, challenges such as data leakage, exposure of user information, and authentication vulnerabilities persist in the current digital landscape. Moreover, the increasing complexity of network patterns demands more sophisticated mechanisms for identifying subtle anomalies and for processing and extracting meaningful insights [4] especially where bandwidth constraints and real-time processing are critical. DDoS attacks, or Distributed Denial-of-Service attacks, follow the same evolutionary pattern as data itself, becoming
This manuscript has been accepted for presentation at the IEEE International Symposium on Computers and Communications (ISCC 2026).
views the related studies. Section 3 details the proposed workflow. Section 4 describes the implementation, experimental setup, and results. Finally, Section 5 discusses the conclusions and outlines possible directions for future research. II. R ELATED W ORK
This study proposes a systematic evaluation framework to examine how feature-space growth impacts classifier performance when features are fused via the generalized Choquet integral versus a non-aggregated baseline. Concretely, we construct incremental feature sets of size k=1,. . . ,10 and evaluate each configuration under two parallel pipelines: (i) Choquetbased feature fusion and (ii) the same features without Choquet aggregation. We then train Random Forest and XGBoost models on both pipelines using identical data splits and report accuracy, precision, recall, and F1-score. By comparing performance trajectories as k increases and by analyzing the deltas between the pipelines, this research aims to quantify the contribution of fuzzy aggregation to predictive effectiveness as the feature space expands. In this work, anomaly detection is treated in the context of smart cities, where cognitive clouds must process massive streams of data from diverse IoT sensors. Managing high-dimensional traffic becomes a critical challenge for privacy-aware and latency-sensitive applications.
M AC A C N E U P SC TE RI D PT
In this section, we discuss research efforts relevant to the scope of this paper. Accordingly, studies that have made notable contributions to fuzzy modeling, dimensionality reduction, and anomaly detection systems were reviewed. The study [11] presents a network traffic predictor based on generalized Choquet integrals with adaptive weighting. Its goal is to improve large-scale traffic forecasting by analyzing how the parameter α affects both prediction accuracy and execution time. The authors used a processed version of the CICDDoS2019 dataset, applying sliding-window and aggregation techniques to capture temporal behavior. Three strategies were tested to select the optimized α: brute force, binary search, and random binary search. The results show that the binary and random approaches considerably reduce execution time, achieving reductions of 56.75% and 59.49% compared to brute force, while maintaining good accuracy. Among the evaluated models, the Choquet (a) formulation achieved the lowest average prediction error. However, the study focuses only on traffic volume prediction and α selection, without extending the analysis to other network indicators or to improving classification-based detection methods, which is the focus of this work. The study [3] investigates the use of the generalized Choquet integral as a feature engineering technique to improve the performance of Random Forest and XGBoost models. Using features from the CIC-DDoS2019 dataset, the authors evaluated classification performance under different aggregation settings. The results show clear gains for both models after introducing the Choquet-based feature. Random Forest achieved improvements of 4.59% in accuracy, 37% in recall, and 16% in F1-score, while XGBoost showed gains of 4.46% in accuracy, 35% in recall, and 16% in F1-score. Despite these positive results, the approach applied the Choquet integral only to the top-ranked feature and restricted the classification to four attributes, which differs from the broader analysis conducted in this work. In [13] presents a modular anomaly detection and mitigation system for SDN environments. Based on Long Short-Term Memory with fuzzy logic (LSTM-FUZZY), the approach comprises three phases: characterization, detection, and mitigation. Testing involved SDN flows from Mininet/Floodlight and the CICDDoS 2019 dataset, validating the modules’ effectiveness by operating autonomously and using the system to eliminate human intervention and supports network administrators in maintaining operational efficiency. Its modular architecture is a key strength, allowing the integration of diverse techniques an essential feature for adapting to evolving network dynamics and security demands.
III. P ROPOSAL
A. Conceptual Model
Figure 1 serves as the conceptual basis of this study, outlining its main stages and illustrating the workflow, key components, and their interrelations. Analysis of the results obtained and model performance
?
Calculate and plot the classifiers behavior when the feature space expands
?
Applying machine learning algorithms with the new Choquet-features and in the original features group
?
Application of choquet integral in the selected features
?
Execution of the feature selection algorithm
?
Data pré-processing
?
Fig. 1. Conceptual workflow illustrating the stages from data preprocessing to model evaluation, including feature selection and Choquet-based feature construction.
1) Data pre-processing: The network dataset is cleaned, normalized, and organized into a structured format suitable for the generalized Choquet Integral algorithm, ensuring data consistency for subsequent phases. (Step 1 in Fig. 1) 2) Execution of the feature selection algorithm: A feature selection procedure ranks attributes based on their statistical contribution to the classification task, identifying the most informative subset for the model. (Step 2 in Fig. 1)
The Poisson Moving Average (PMA) is employed as a weighting factor and used as fuzzy measure, being defined from a truncated Poisson distribution parameterized by the sliding window size W . The weights associated with each position i within the window are given by µi =
W i e−W , i!
i = 1, 2, . . . , W,
B. Aggregation Functions and the Choquet Integral The Choquet integral [14] is a central aggregation operator in information fusion and decision-making problems. Let m : 2N → [0, 1] be a fuzzy measure defined on the power set of N = {1, . . . , n} [?]. The discrete Choquet integral associated with m is the mapping Cm : [0, 1]n → [0, 1] given, for any x ∈ [0, 1]n , by Cm (x) =
n X
x(i) − x(i−1) m A(i) ,
(1)
i=1
where (x(1) , . . . , x(n) ) denotes an increasing permutation of the components of x, with x(0) = 0, and A(i) = {(i), . . . , (n)} represents the subset of indices corresponding to the n − i + 1 largest components of x. By distributing the product in (1), the Choquet integral can be equivalently expressed in its expanded form as Cm (x) =
n X
x(i) m A(i) − x(i−1) m A(i) .
(2)
i=1
This expanded representation serves as the foundation for the CC-integral [9], a generalization of the Choquet integral in which the product operator is replaced by a copula function [15]. Let the operator m : 2N → [0, 1] be a fuzzy measure and consider a bivariate copula C : [0, 1]2 → [0, 1]. The CCn integral is defined as a mapping CC m : [0, 1] → [0, 1], given, ∀x = (x1 , . . . , xn ) ∈ [0, 1]n , by CC m (x) =
n X
C x(i) , m A(i)
− C x(i−1) , m A(i)
,
(3)
i=1
where x(i) and A(i) are defined in the same way as Eq. (1). Building upon this idea, a parametric family known as the Cα C-integrals s [9] was introduced by combining CCintegrals with α-parameterized copulae, like the ones shown in Table I. The Cα C-integrals constitute the aggregation framework adopted in this work.
(4)
and are subsequently normalized such that sum from i = 1 to W of µi = 1. This approach allows adjusting the temporal influence of the elements within the window, making the aggregation process more sensitive to the dynamics of the analyzed data. C. Work definitions Before presenting the experimental results, it is necessary to clarify some concepts used throughout this work. 1) Choquet-based feature: In this work, the term Choquetbased feature refers to a new synthetic attribute generated through the generalized Choquet Integral. Another key aspect is the parameter k, which denotes the number of selected features used in each experimental configuration. 2) ∆Y (Performance gain): Throughout this paper, the symbol ∆Y represents the improvement obtained when using the Choquet-based aggregated feature compared to the baseline without aggregation. where Y is the accuracy and a positive ∆Y indicates that the Choquet aggregation improves model performance, while a negative value indicates performance degradation. This metric enables direct comparison between both approaches at each feature-set size k, allowing identification of the most effective operating range for the aggregated feature.
M AC A C N E U P SC TE RI D PT
3) Application of Choquet integral in the selected features: Highest-ranked features are progressively aggregated via the generalized Choquet integral to create synthetic attributes that capture nonlinear interactions and dependencies. (Step 3 in Fig. 1) 4) Applying machine learning algorithms: Classifiers are trained using both the original feature set and the enhanced dataset (including Choquet-aggregated features) to enable a controlled comparison of both scenarios. (Step 4 in Fig. 1) 5) Calculate and plot classifier behavior: The feature space is incremented gradually (k = 1, 2, . . . , 10), recording metrics such as accuracy, precision, recall, and F1-score to visualize performance evolution as dimensionality increases. (Step 5 in Fig. 1) 6) Analysis of results and performance: The collected metrics are examined to quantify the influence of Choquet-based aggregation on predictive capacity, highlighting the approach’s impact on classification performance. (Step 6 in Fig. 1)
D. Classify Algorithm Methods
This study evaluates the proposed feature engineering approach using two tree-based ensemble methods: Random Forest (RF) [16] and XGBoost [17]. While both rely on decision tree architectures, they utilize fundamentally different construction strategies: • Random Forest: Employs a bagging technique where multiple trees are built independently using bootstrap samples and random feature subsets. The final classification is reached through majority voting, a process that minimizes correlation between trees, enhances generalization, and ensures robustness against noise in highdimensional network data. • XGBoost: Implements a gradient boosting framework where trees are trained sequentially to minimize the residual errors of the preceding ensemble. It incorporates L1 and L2 regularization and a specific learning rate to prevent overfitting, offering high predictive performance and efficiency in handling sparse datasets. Comparison: RF is characterized by its stability and reliable performance with minimal hyperparameter tuning, making it suitable for establishing a baseline in anomaly detection. In contrast, XGBoost typically achieves superior accuracy by capturing complex, non-linear patterns in traffic data, though
TABLE I TABLE OF G ENERALIZATIONS OF THE C HOQUET I NTEGRAL U SED TO G ENERATE A N EW F EATURE .
Copula Functions α constraints (A) Cα (x, y) = xy[1 + α(1 − x)(1 − y)] −1 ≤ α ≤ 1 1 max[x + y − 1 + α − α|x − y|, 0] 0<α<1 (B) Cα (x, y) = 1+α (C) Cα = (1 − α)W + α min 0<α<1 2 2 (D) Cα = α (1−α) W + (1 − α2 )P + α (1+α) min −1 < α < 1(α ̸= 0) 2 2
it requires more precise tuning to balance performance and computational overhead.
B. Accuracy Comparison: With vs. Without Choquet Feature
IV. E VALUATION
TABLE III ACCURACY DIFFERENCE (∆Y ) BETWEEN C HOQUET- BASED AND BASELINE FEATURES FOR THE FIRST TEN FEATURE SUBSETS (R ANDOM F OREST ).
M AC A C N E U P SC TE RI D PT
To assess the effectiveness of the proposed feature engineering approach, this section analyzes how the feature space evolves as more features are included. A. Data preprocessing and feature selection algorithm
Before generating the new Choquet–based feature, the dataset was preprocessed to ensure data consistency and model reliability. The raw CIC-DDoS2019 dataset composed of 692703 rows and 79 columns was cleaned using Pandas and NumPy, including handling missing values and converting categorical attributes into numerical form. After preprocessing, a comparative analysis of different selection methods was conducted choosing SelectKBest, the algorithm was ultimately selected for providing the most consistent ranking for our classification task, producing the top 10 most relevant attributes shown in Table II. This preprocessing and feature-selection also significantly reduces the dataset size by 77.5%, shrinking it from 214 MB to 48 MB, which improves training efficiency and speeds up experimentation in bandwidth-constrained smart city environments. The choice of selecting only the top 10 features was intentional. Preliminary experiments showed that, for both Random Forest and XGBoost, the performance tends to stabilize once more than 6–7 features are used as shown in the performance curves in Fig. 2 and 3, therefore, limiting the feature space to 10 attributes prevents the model from incorporating unnecessary information, while still allowing the evaluation of how performance evolves as the feature space gradually expands. This makes the analysis more controlled and avoids feeding excessive or redundant features to the classifiers. TABLE II T OP -10 SELECTED FEATURES BASED ON S ELECT KB EST. Rank 1st 2nd 3rd 4th 5th 6th 7th 8th 9th 10th
Feature Bwd Packet Length Mean Avg Bwd Segment Size Bwd Packet Length Std Bwd Packet Length Max Packet Length Std Max Packet Length Fwd IAT Max Flow IAT Max Packet Length Mean Packet Length Variance
Score 112023.06 112023.06 108310.46 106125.98 101429.54 94126.52 93922.66 93525.75 84086.98 82271.07
Feature YChoquet YBaseline ∆Y = YChoquet − YBaseline 1 0.931 0.870 0.061 2 0.934 0.870 0.064 3 0.941 0.870 0.071 4 0.953 0.880 0.073 5 0.948 0.909 0.039 6 0.962 0.990 -0.028 7 0.964 0.984 -0.020 8 0.965 0.985 -0.020 9 0.964 0.984 -0.020 10 0.963 0.983 -0.020
TABLE IV ACCURACY DIFFERENCE (∆Y ) BETWEEN C HOQUET- BASED AND BASELINE FEATURES FOR THE FIRST TEN FEATURE SUBSETS (XGB OOST ). Feature YChoquet YBaseline ∆Y = YChoquet − YBaseline 1 0.924 0.860 0.064 2 0.923 0.857 0.066 3 0.934 0.864 0.070 4 0.951 0.880 0.071 5 0.947 0.903 0.044 6 0.962 0.986 -0.024 7 0.964 0.986 -0.022 8 0.965 0.986 -0.021 9 0.966 0.987 -0.021 10 0.967 0.988 -0.021
Figs. 2, 3 and Tables III, IV present the accuracy evolution as the feature space grows (from 1 to 10 features), comparing the traditional feature set against the configuration that incorporates the Choquet-based feature. As can be observed, when only a small number of features is available, the configuration with the Choquet–based feature yields consistently higher accuracy compared to the baseline without aggregation. As the number of features increases, the performance gap gradually narrows, and both approaches converge to similar accuracy levels once additional raw features are incorporated. The best k for Random Forest and XGBoost, the largest accuracy gain occurs at k = 4 (∆Y = 0.07), indicating an effective positive operating window at k ∈ [1, 5] before both curves saturate and converge for k ≥ 6. C. Detection performance To better understand how the Choquet-based feature impacts the classifiers, confusion matrices were generated for both al-
Fig. 4. Confusion matrix of the classifier trained using only the original selected features (baseline) for 4 features.
M AC A C N E U P SC TE RI D PT
Fig. 2. The evolution of the accuracy according to the number of features (Random Forest).
Fig. 3. The evolution of the accuracy according to the number of features (XGBoost).
Fig. 5. Confusion matrix of the classifier trained with the addition of the generalized Choquet-based feature for 4 features.
gorithms under two conditions: (i) using only the raw selected features, and (ii) using the same features with the addition treatment of the Choquet-aggregated feature. Remember that 4 features are used for Random Forest and XGBoost, since Tables III and IV indicate that these configurations yield the highest accuracy for each model and so well the best (∆Y ). For Random Forest and XGBoost Without Choquet in Fig. 4, the confusion matrix shows that the model correctly classifies 83% of benign traffic (true label 0) and 99% of attacks (true label 1), with 17% of benign samples flagged as attacks (false positives) and only 1% of attacks missed (false negatives). With the Choquet feature in Fig. 5, benign detection improves substantially to 97% (false positives drop to 3%), while attack detection decreases to 93% (false negatives rise to 7%). This reflects a clear trade-off : the Choquet aggregation greatly reduces false alarms on benign traffic, at the cost of a higher miss rate on attacks; the baseline does the opposite, identifying attacks extremely well but misclassifying more benign samples. D. Discussion of results Overall, the results consistently indicate that fuzzy aggregation via the generalized Choquet integral is most beneficial
when the feature space is small and interactions among variables are not yet well represented by raw attributes. From a data perspective, the pipeline begins with a compact and reliable basis: the CIC-DDoS2019 dataset (692,703 rows, 79 columns) is cleaned and reduced through SelectKBest to a controlled search space of up to k = 10 features, an upper bound chosen because the accuracy curves stabilize after 6–7 features for both models (Fig. 2 and 3). This design avoids injecting superfluous information while still exposing the performance trajectory as k increases. Methodologically, the comparison is fair: both pipelines (with and without the Choquet-based aggregated feature) share identical splits, training settings, and evaluation protocol. Empirically, Fig. 2 and 3 and Tables III and IV reveal a consistent pattern: with few features (k! ∈![1, 5]), the Choquetaugmented pipeline outperforms the baseline; as k increases, the gap narrows, and both models converge for k! ≥!6–7. The largest improvement occurs at k = 4, with ∆Y ≈ 0.07, indicating that fuzzy aggregation enables the classifiers to achieve high accuracy using fewer attributes. The confusion matrices (Fig. 4 and 5, shown for the best-k configuration)
calibration to manage the observed trade-off between reducing false positives and the potential rise in false negatives. Future work will focus on extending this framework to compare against alternative dimensionality reduction techniques such as PCA, autoencoders, and recursive feature elimination, as well as on analyzing the computational latency of the Choquet aggregation for real-time deployment. We also plan to conduct sensitivity analysis of the copula parameter α and the integration of the model with streaming-based intrusion detection systems. R EFERENCES [1] H. A. Almazarqi, M. Woodyard, and A. K. Marnerides, “Dynamics of large-scale ddos attacks orchestrated by iot botnets,” in 2025 IEEE Symposium on Computers and Communications (ISCC), 2025, pp. 1–6. [2] B. L. Dalmazo, J. P. Vilela, and M. Curado, “Triple-Similarity Mechanism for Alarm Management in the Cloud,” Computers & Security - Elsevier, vol. 78, pp. 33–42, 2018. [Online]. Available: http://www.sciencedirect.com/science/article/pii/S0167404818306515 [3] A. Quevedo, D. Ayres, G. Teixeira, G. Dimuro, G. Lucca, and B. L. Dalmazo, “Improving anomaly detection in network traffic using choquetbased feature engineering for random forest and xgboost models,” in Computational Science and Its Applications – ICCSA 2025. Cham: Springer Nature Switzerland, 2025, pp. 3–16. [4] F. C. Cardoso, R. A. Berri, E. N. Borges, B. L. Dalmazo, G. Lucca, and V. L. D. de Mattos, “Echo state network and classical statistical techniques for time series forecasting: A review,” Knowledge-Based Systems, vol. 293, p. 111639, 2024. [5] O. Yoachimik and J. Pacheco. (2025) Cloudflare’s 2025 q3 ddos threat report – including aisuru, the apex of botnets. CloudFlare. Accessed: 28 January, 2026. [Online]. Available: https://blog.cloudflare.com/ddosthreat-report-2025-q3/ [6] J. Nelson. (2025, mar) X outage linked to dark storm hacker group as elon musk confirms ’massive cyberattack’. Accessed: 2025-09-10. [Online]. Available: https://decrypt.co/309371/x-outagelinked-dark-storm-hacker-group [7] G. Lucca, G. P. Dimuro, B. Bedregal, J. A. Sanz, and H. Bustince, “A proposal for tuning the alpha parameter in a copula function applied in fuzzy rule-based classification systems,” in 2016 5th Brazilian Conference on Intelligent Systems (BRACIS), 2016, pp. 367–372. [8] G. Choquet, “Theory of capacities,” Annales de l’Institut Fourier, vol. 5, pp. 131–295, 1953. [9] J. Li, J. Ma, O. M. Omisore, Y. Liu, H. Tang, P. Ao, Y. Yan, L. Wang, and Z. Nie, “Noninvasive blood glucose monitoring using spatiotemporal ecg and ppg feature fusion and weight-based choquet integral multimodel approach,” IEEE Transactions on Neural Networks and Learning Systems, vol. 35, no. 10, pp. 14 491–14 505, 2024. [10] M. Amorim, G. Lucca, B. L. Dalmazo, C. Marco-Detchart, and G. P. Dimuro, “Generalizations of choquet-like integrals by restricted dissimilarity functions applied to multi-channel edge detection problems,” Applied Sciences, vol. 15, no. 24, 2025. [Online]. Available: https://www.mdpi.com/2076-3417/15/24/13273 [11] A. Quevedo, D. Ayres, G. Dimuro, A. Riker, G. Lucca, and B. L. Dalmazo, “Optimizing big data traffic prediction using generalizations of choquet integral with adaptive weighting,” in ICC 2025 - IEEE International Conference on Communications, 2025, pp. 4872–4877. [12] L. Leite, Y. Santo, B. Dalmazo, and A. Riker, “Federated learning under attack: Improving gradient inversion for batch of images,” in Anais do XXIV Simpósio Brasileiro de Segurança da Informação e de Sistemas Computacionais. Porto Alegre, RS, Brasil: SBC, 2024, pp. 794–800. [Online]. Available: https://sol.sbc.org.br/index.php/sbseg/article/view/30070 [13] M. P. Novaes, L. F. Carvalho, J. Lloret, and M. L. Proença, “Long shortterm memory and fuzzy logic for anomaly detection and mitigation in software-defined network environment,” IEEE Access, vol. 8, pp. 83 765–83 781, 2020. [14] M. Amorim, G. Dimuro, E. Borges, B. L. Dalmazo, C. Marco-Detchart, G. Lucca, and H. Bustince, “Systematic review of aggregation functions applied to image edge detection,” Axioms, vol. 12, no. 4, 2023.
M AC A C N E U P SC TE RI D PT
reinforce this result by highlighting a practical trade-off: the baseline favors maximum attack detection but produces more false positives on benign traffic, whereas the Choquet-based model substantially reduces false alarms (higher true-negative rate) at a modest cost in missed attacks. In short, the generalized Choquet aggregation delivers better accuracy in low-dimensional data, enabling robust detection even in resource-constrained environments. Once the feature set surpasses k ≈ 6–7, the benefits decrease as both pipelines approach their ceiling. These findings support the use of Choquet-based fusion as a compact, interaction-aware representation that accelerates performance while controlling dimensionality. Beyond the quantitative gains, the results highlight practical implications for large-scale network monitoring. The proposed Choquet-based aggregation offers a balanced trade-off between feature expressiveness and computational cost, making it suitable for deployment in data centers or backbone networks where massive traffic must be analyzed under strict latency constraints. Although the experiments were performed on offline batches of the CIC-DDoS2019 dataset, the methodology remains compatible with streaming frameworks, as the aggregation can be computed incrementally as new features arrive. This property indicates that the approach can be integrated into data analytics pipelines, enabling real-time anomaly detection without compromising interpretability or scalability. V. C ONCLUSION
This work presented a feature aggregation strategy based on a generalized Choquet integral to enhance network anomaly detection, particularly in scenarios with limited feature availability. By modeling nonlinear dependencies among selected attributes through fuzzy measures, the proposed approach improves predictive performance without requiring additional raw features. An additional side effect of the experimental setup was a reduction in data volume, resulting from feature selection rather than the Choquet aggregation itself. Furthermore, the results suggest a favorable trade-off: the Choquet model reduces false positives while slightly increasing false negatives, which can be balanced by threshold calibration. This high true-negative rate allows its use as an efficient first defense layer to filter benign traffic before more resource-intensive analysis. When evaluated over repeated stratified experiments, the performance gains were statistically significant (p < 0.05) for both classifiers, positioning the generalized Choquet integral as a viable candidate for largescale smart city deployments. In such scenarios, edge devices must process information locally to avoid saturating distributed cloud networks during massive DDoS events, making this high efficiency aggregation essential. Despite these gains, the approach has limitations. The aggregation’s effectiveness remains dependent on the initial feature selection quality, and the computational complexity of calculating fuzzy measures increases with the number of features, which may hinder performance if k is too large. Additionally, the current model requires careful threshold
M AC A C N E U P SC TE RI D PT
[15] C. Alsina, B. Schweizer, and M. J. Frank, Associative functions: triangular norms and copulas. World Scientific, 2006. [16] L. Breiman, “Random forests,” Machine learning, vol. 45, no. 1, pp. 5–32, 2001. [17] T. Chen and C. Guestrin, “Xgboost: A scalable tree boosting system,” in Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, ser. KDD ’16. Association for Computing Machinery, 2016, p. 785–794.