Improving Network Anomaly Detection via Choquet-Integral-Based Feature Aggregation

2026-07-16

AI Summary

This study addresses the challenge of feature redundancy in high-dimensional network traffic data, which hinders the efficiency and real-time performance of anomaly detection. To overcome this limitation, the work proposes a novel feature aggregation framework that, for the first time, integrates the Choquet integral into network anomaly detection by combining adaptive weighting with incremental feature selection. This approach substantially reduces data dimensionality while simultaneously enhancing detection accuracy. Experimental results demonstrate that, using only the most critical features, the proposed method achieves up to a 7% improvement in accuracy over baseline models, compresses data volume by 77.5% (from 214 MB to 48 MB), and exhibits statistically significant superiority (p < 0.05).

Abstract

This work investigates a generalized Choquet-integral-based feature aggregation framework to improve anomaly detection in high-dimensional network traffic data. The approach combines adaptive weighting with incremental feature selection to address feature redundancy. Using Random Forest and XGBoost classifiers, we evaluate models trained with both raw and Choquet-aggregated features under varying feature subset sizes. The proposed aggregation achieves up to $7\%$ higher accuracy while reducing data volume by $77.5\%$ (from $214$~MB to $48$~MB), without degrading precision and recall. Results averaged over multiple stratified repetitions indicate that Choquet-based aggregation yields statistically significant gains ($p < 0.05$) in scenarios with limited feature availability, highlighting its suitability for real-time intrusion detection under bandwidth and feature-availability constraints.

Problem

• network anomaly detection
• feature redundancy
• high-dimensional data
• real-time intrusion detection
• feature availability

Innovation

• Choquet integral
• feature aggregation
• anomaly detection
• feature selection
• network security