Adaptive class-aware feature selection for high-dimensional and imbalanced multi-class network intrusion detection.

Abstract

High-dimensional feature spaces and severe class imbalance remain fundamental challenges for Machine Learning-based Network Intrusion Detection Systems (ML-NIDS), where minority attack categories are frequently overlooked during feature selection. Existing feature selection approaches commonly rely on global feature relevance measures and manually specified feature counts, which favor majority traffic classes and reduce sensitivity toward rare but critical attack categories. To address these limitations, this study proposes the Adaptive Class-Aware Feature Selection (ACAFS) framework for multi-class intrusion detection. Unlike conventional approaches, ACAFS introduces a data-driven adaptive feature count mechanism based on permutation null hypothesis testing, a Class-Aware Composite Mutual Information scoring strategy that explicitly preserves minority-class discriminative information, and a coordinated two-stage feature selection framework that combines statistical filtering with XGBoost-based model refinement. The framework was evaluated independently on the CSE-CIC-IDS2018 benchmark dataset and a Simulated University Network Environment (SUNE) dataset representing Tanzanian higher learning institution networks. Experimental results demonstrate that ACAFS substantially reduces feature dimensionality while improving balanced intrusion detection performance. On CSE-CIC-IDS2018, ACAFS reduced the feature space from 74 to 22 features, representing a 70.3% dimensionality reduction, while the Two-Stage CNN achieved 99.39% accuracy, 99.40% F1-score, and a false positive rate of 0.09%. The framework further achieved 98.59% recall for Web_Attacks despite severe class imbalance, demonstrating effective preservation of minority-class discriminative features. On the SUNE dataset, ACAFS independently selected 18 features and maintained stable detection performance without dataset-specific manual tuning, confirming its adaptability across heterogeneous network environments. These results confirm that adaptive and class-aware feature selection can simultaneously reduce feature redundancy, improve minority attack detection, and maintain robust intrusion detection performance across diverse network traffic environments.