# LEMDA: A Novel Feature Engineering Method for Intrusion Detection in IoT Systems

arXiv: https://arxiv.org/abs/2404.16870 · HTML: https://mlsanity.com/paper/2404.16870/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 52 references that are in the map.
- First posted on arXiv 20 Apr 2024.

## Builds on (most cited first, 4 of 4)

- [Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset](https://mlsanity.com/paper/1811.00701/) (2018)
- [Feature selection revisited in the single-cell era](https://mlsanity.com/paper/2110.14329/) (2021)
- [Explainable Artificial Intelligence for Pharmacovigilance: What Features Are Important When Predicting Adverse Outcomes?](https://mlsanity.com/paper/2112.13210/) (2021)
- [A Sequential Supervised Machine Learning Approach for Cyber Attack Detection in a Smart Grid System](https://mlsanity.com/paper/2108.00476/) (2021)

## Built on by (most cited first, 1 of 1)

- [On the Performance of Cyber-Biomedical Features for Intrusion Detection in Healthcare 5.0](https://mlsanity.com/paper/2506.17329/) (2025)

## Abstract (arXiv)

Intrusion detection systems (IDS) for the Internet of Things (IoT) systems can use AI-based models to ensure secure communications. IoT systems tend to have many connected devices producing massive amounts of data with high dimensionality, which requires complex models. Complex models have notorious problems such as overfitting, low interpretability, and high computational complexity. Adding model complexity penalty (i.e., regularization) can ease overfitting, but it barely helps interpretability and computational efficiency. Feature engineering can solve these issues; hence, it has become critical for IDS in large-scale IoT systems to reduce the size and dimensionality of data, resulting in less complex models with excellent performance, smaller data storage, and fast detection. This paper proposes a new feature engineering method called LEMDA (Light feature Engineering based on the Mean Decrease in Accuracy). LEMDA applies exponential decay and an optional sensitivity factor to select and create the most informative features. The proposed method has been evaluated and compared to other feature engineering methods using three IoT datasets and four AI/ML models. The results show that LEMDA improves the F1 score performance of all the IDS models by an average of 34% and reduces the average training and detection times in most cases.