aiqbench analysis
This research introduces nCMD, a novel feature selection technique specifically designed to address class imbalance in network intrusion detection systems by anchoring metrics to benign traffic distributions. The method demonstrates superior performance on standard benchmarks with minimal computational overhead, offering a practical preprocessing solution for resource-constrained security environments. By aligning feature ranking with the inherent asymmetry of attack detection, this work advances machine learning methodologies for high-dimensional cybersecurity data.
nCMD: Benign-Anchored Feature Selection for Imbalanced Network Intrusion Detection
arXiv:2606.09934v2 Announce Type: replace Abstract: Feature selection is critical for network intrusion detection systems (NIDS) operating under high-dimensional, highly imbalanced traffic, as found in operational and defense networks. Traditional filter methods rank features using global statistics computed symmetrically across classes and thus fail to capture the asymmetry of intrusion detection, where attacks are best characterized as deviations from dominant benign traffic. We propose benign-anchored Classwise Mean Deviation (nCMD), a lightweight and interpretable method that scores feature relevance based on the deviation of attack-class distributions from the benign-class mean, rather than a globally biased reference. This approach aligns feature selection with the operational semantics of NIDS at no additional computational cost. Across four benchmark datasets (CICIDS2017, CICDDoS2019, NSL-KDD, and UNSW-NB15), multiple feature budgets, and three downstream classifiers, nCMD matches or exceeds classical filter baselines in macro-averaged F1-score. It achieves the best result on three of the four datasets and under every classifier, with the strongest improvements observed under tight feature budgets and severe class imbalance. These results support benign-anchored ranking as a scalable and interpretable preprocessing component for resource-constrained NIDS.
Abstract:Feature selection is critical for network intrusion detection systems (NIDS) operating under high-dimensional, highly imbalanced traffic, as found in operational and defense networks. Traditional filter methods rank features using global statistics computed symmetrically across classes and thus fail to capture the asymmetry of intrusion detection, where attacks are best characterized as deviations from dominant benign traffic. We propose benign-anchored Classwise Mean Deviation (nCMD), a lightweight and interpretable method that scores feature relevance based on the deviation of attack-class distributions from the benign-class mean, rather than a globally biased reference. This approach aligns feature selection with the operational semantics of NIDS at no additional computational cost. Across four benchmark datasets (CICIDS2017, CICDDoS2019, NSL-KDD, and UNSW-NB15), multiple feature budgets, and three downstream classifiers, nCMD matches or exceeds classical filter baselines in macro-averaged F1-score. It achieves the best result on three of the four datasets and under every classifier, with the strongest improvements observed under tight feature budgets and severe class imbalance. These results support benign-anchored ranking as a scalable and interpretable preprocessing component for resource-constrained NIDS.
Machine Learning (cs.LG); Cryptography and Security (cs.CR)
arXiv:2606.09934 [cs.LG]
(or arXiv:2606.09934v2 [cs.LG] for this version)
https://doi.org/10.48550/arXiv.2606.09934 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 270 words
Related coverage
nCMD: Benign-Anchored Feature Selection for Imbalanced Network Intrusion Detection
arXiv · Jun 10, 2026
BARS: Benign-Anchored Ranking and Selection for False Alarm Reduction in Network Intrusion Detection
arXiv · Sep 30, 2026
Multi-Class, Multi-Tier Network Intrusion Detection: A Comprehensive and Reproducible Benchmark
arXiv · Sep 30, 2026
News
Quantum Computing Report · Jun 7, 2026