🤖 AI Summary
This study addresses the high false positive rates in high-traffic network intrusion detection caused by class imbalance. To this end, the authors propose BARS, a two-stage feature selection method that replaces the conventional global mean with the mean of benign traffic as an anchor point and incorporates an order-preserving decorrelation mechanism to more accurately model the benign baseline under imbalanced conditions. BARS is the first approach to explicitly align feature selection anchors with the benign distribution, effectively mitigating anchor shift while maintaining linear time complexity and low memory overhead. Experimental results on the UNSW-NB15 and CICDDoS2019 datasets show that BARS reduces false positive rates by 15.4%–23% compared to the CMD method, achieves comparable recall and macro-F1 scores, and incurs significantly lower memory usage than mutual information–based approaches.
📝 Abstract
False alarms remain a major barrier to deploying network intrusion detection systems (NIDS). In high-volume environments, even a sub-1% false positive rate can generate tens of thousands of daily alerts. Filter-based feature selection is attractive because it operates upstream of the classifier and adds no inference-time cost. However, classical filters use class-symmetric criteria that ignore the asymmetry of intrusion detection, where benign traffic defines the baseline and attacks are deviations from it. A recent class-asymmetric filter, Classwise Mean Deviation (CMD), addresses this issue but anchors its score to a global mean that shifts toward attack distributions under class imbalance, weakening the deviations it aims to capture.
We propose Benign-Anchored Ranking and Selection (BARS), a two-stage filter that replaces CMD's global anchor with the benign-class mean and applies an order-preserving decorrelation step. We evaluate BARS on CICIDS2017, CICDDoS2019, and UNSW-NB15 using feature budgets k = {5, 10, 20, 30, 40}. On attack-majority datasets, where global-anchor bias is strongest, BARS reduces false positive rate relative to CMD by 15.4% on UNSW-NB15 at k = 20 and by 21% to 23% on CICDDoS2019 at small feature budgets while preserving true positive rate and macro-F1. On benign-majority data, BARS and CMD converge, consistent with the theoretical limit where global- and benign-anchored scores coincide. BARS is a principled refinement of CMD rather than a universally dominant filter. Although Pearson Correlation and Mutual Information often achieve lower false positive rates, they exceeded 1 TB of memory on the largest benchmarks in our evaluation. BARS retains linear-time scoring and a low memory footprint, making it suitable for resource-constrained deployments.