# Supervised Feature Selection Techniques in Network Intrusion Detection: a Critical Review

arXiv: https://arxiv.org/abs/2104.04958 · HTML: https://mlsanity.com/paper/2104.04958/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 158 references that are in the map.
- First posted on arXiv 11 Apr 2021.

## Builds on (most cited first, 8 of 8)

- [Multi-Stage Optimized Machine Learning Framework for Network Intrusion Detection](https://mlsanity.com/paper/2008.03297/) (2020)
- [Machine Learning in Network Centrality Measures: Tutorial and Outlook](https://mlsanity.com/paper/1810.11760/) (2018)
- [A Graph-Based Machine Learning Approach for Bot Detection](https://mlsanity.com/paper/1902.08538/) (2019)
- [Experimental Review of Neural-based approaches for Network Intrusion Management](https://mlsanity.com/paper/2009.09011/) (2020)
- [Improving SIEM capabilities through an enhanced probe for encrypted Skype traffic detection](https://mlsanity.com/paper/1711.00524/) (2017)
- [Building an Effective Intrusion Detection System using Unsupervised Feature Selection in Multi-objective Optimization Framework](https://mlsanity.com/paper/1905.06562/) (2019)
- [Privacy-Preserving DDoS Attack Detection Using Cross-Domain Traffic in Software Defined Networks](https://mlsanity.com/paper/1809.07046/) (2018)
- [Availability Evaluation of Multi-tenant Service Function Chaining Infrastructures by Multidimensional Universal Generating Function](https://mlsanity.com/paper/2009.13141/) (2020)

## Built on by (most cited first, 7 of 7)

- [Pruning-Based TinyML Optimization of Machine Learning Models for Anomaly Detection in Electric Vehicle Charging Infrastructure](https://mlsanity.com/paper/2503.14799/) (2025)
- [Deep Neural Networks based Meta-Learning for Network Intrusion Detection](https://mlsanity.com/paper/2302.09394/) (2023)
- [Exploring Feature Importance and Explainability Towards Enhanced ML-Based DoS Detection in AI Systems](https://mlsanity.com/paper/2411.03355/) (2024)
- [Online Feature Selection for Efficient Learning in Networked Systems](https://mlsanity.com/paper/2112.08253/) (2021)
- [A Tent L'evy Flying Sparrow Search Algorithm for Feature Selection: A COVID-19 Case Study](https://mlsanity.com/paper/2209.10542/) (2022)
- [Revisiting Network Traffic Analysis: Compatible network flows for ML models](https://mlsanity.com/paper/2511.08345/) (2025)
- [DNS-GT: A Graph-based Transformer Approach to Learn Embeddings of Domain Names from DNS Queries](https://mlsanity.com/paper/2603.11200/) (2026)

## Abstract (arXiv)

Machine Learning (ML) techniques are becoming an invaluable support for network intrusion detection, especially in revealing anomalous flows, which often hide cyber-threats. Typically, ML algorithms are exploited to classify/recognize data traffic on the basis of statistical features such as inter-arrival times, packets length distribution, mean number of flows, etc. Dealing with the vast diversity and number of features that typically characterize data traffic is a hard problem. This results in the following issues: i) the presence of so many features leads to lengthy training processes (particularly when features are highly correlated), while prediction accuracy does not proportionally improve; ii) some of the features may introduce bias during the classification process, particularly those that have scarce relation with the data traffic to be classified. To this end, by reducing the feature space and retaining only the most significant features, Feature Selection (FS) becomes a crucial pre-processing step in network management and, specifically, for the purposes of network intrusion detection. In this review paper, we complement other surveys in multiple ways: i) evaluating more recent datasets (updated w.r.t. obsolete KDD 99) by means of a designed-from-scratch Python-based procedure; ii) providing a synopsis of most credited FS approaches in the field of intrusion detection, including Multi-Objective Evolutionary techniques; iii) assessing various experimental analyses such as feature correlation, time complexity, and performance. Our comparisons offer useful guidelines to network/security managers who are considering the incorporation of ML concepts into network intrusion detection, where trade-offs between performance and resource consumption are crucial.