# Feature Selection for Network Intrusion Detection

arXiv: https://arxiv.org/abs/2411.11603 · HTML: https://mlsanity.com/paper/2411.11603/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 74 references that are in the map.
- First posted on arXiv 18 Nov 2024.

## Builds on (most cited first, 14 of 14)

- [Representation Learning with Contrastive Predictive Coding](https://mlsanity.com/paper/1807.03748/) (2018)
- [On Variational Bounds of Mutual Information](https://mlsanity.com/paper/1905.06922/) (2019)
- [Learning to Explain: An Information-Theoretic Perspective on Model Interpretation](https://mlsanity.com/paper/1802.07814/) (2018)
- [Problems with Shapley-value-based explanations as feature importance measures](https://mlsanity.com/paper/2002.11097/) (2020)
- [Feature relevance quantification in explainable AI: A causal problem](https://mlsanity.com/paper/1910.13413/) (2019)
- [Asymmetric Shapley values: incorporating causal knowledge into model-agnostic explainability](https://mlsanity.com/paper/1910.06358/) (2019)
- [Learning to Maximize Mutual Information for Dynamic Feature Selection](https://mlsanity.com/paper/2301.00557/) (2023)
- [Correlation and variable importance in random forests](https://mlsanity.com/paper/1310.5726/) (2013)
- [A Rigorous Information-Theoretic Definition of Redundancy and Relevancy in Feature Selection Based on (Partial) Information Decomposition](https://mlsanity.com/paper/2105.04187/) (2021)
- [A Novel Hierarchical Intrusion Detection System based on Decision Tree and Rules-based Models](https://mlsanity.com/paper/1812.09059/) (2018)
- [Variational Information Maximization for Feature Selection](https://mlsanity.com/paper/1606.02827/) (2016)
- [Ultra-marginal Feature Importance: Learning from Data with Causal Guarantees](https://mlsanity.com/paper/2204.09938/) (2022)
- [A hybrid feature selection for network intrusion detection systems: Central points](https://mlsanity.com/paper/1707.05505/) (2017)
- [Bounds on the Number of Measurements for Reliable Compressive Classification](https://mlsanity.com/paper/1607.02801/) (2016)

## Built on by (most cited first, 3 of 3)

- [An explainable Recursive Feature Elimination to detect Advanced Persistent Threats using Random Forest classifier](https://mlsanity.com/paper/2511.09603/) (2025)
- [nCMD: Benign-Anchored Feature Selection for Imbalanced Network Intrusion Detection](https://mlsanity.com/paper/2606.09934/) (2026)
- [BARS: Benign-Anchored Ranking and Selection for False Alarm Reduction in Network Intrusion Detection](https://mlsanity.com/paper/2607.13203/) (2026)

## Abstract (arXiv)

Network Intrusion Detection (NID) remains a key area of research within the information security community, while also being relevant to Machine Learning (ML) practitioners. The latter generally aim to detect attacks using network features, which have been extracted from raw network data typically using dimensionality reduction methods, such as principal component analysis (PCA). However, PCA is not able to assess the relevance of features for the task at hand. Consequently, the features available are of varying quality, with some being entirely non-informative. From this, two major drawbacks arise. Firstly, trained and deployed models have to process large amounts of unnecessary data, therefore draining potentially costly resources. Secondly, the noise caused by the presence of irrelevant features can, in some cases, impede a model's ability to detect an attack. In order to deal with these challenges, we present Feature Selection for Network Intrusion Detection (FSNID) a novel information-theoretic method that facilitates the exclusion of non-informative features when detecting network intrusions. The proposed method is based on function approximation using a neural network, which enables a version of our approach that incorporates a recurrent layer. Consequently, this version uniquely enables the integration of temporal dependencies. Through an extensive set of experiments, we demonstrate that the proposed method selects a significantly reduced feature set, while maintaining NID performance. Code will be made available upon publication.