Pith. sign in

REVIEW 4 major objections 4 minor 37 references

Explainable AI for Enhancing IDS Against Advanced Persistent Kill Chain

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Twelve traffic features, chosen by SHAP-ranked selection, detect APT phases at 94% macro F1.

desk verdict A standard SHAP+XGBoost feature-selection recipe applied to SCVIC-APT-2021, but the evaluation leaks the test set into feature selection and the reported F1 is not a credible generalization estimate. read the letter →

arxiv 2506.07480 v1 pith:46G6KIO5 submitted 2025-06-09 cs.CR

Bassam Noori Shaker , Bahaa Al-Musawi , Mohammed Falih Hassan This is my paper
classification cs.CR
keywords intrusiondetectionsystemAdvancedPersistentThreatsSHAPfeatureselectionSCVIC-APT-2021XGBoostexplainableAIAPTkillchain
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Advanced persistent threats do not arrive as one attack; they move through phases such as reconnaissance, initial compromise, lateral movement, pivoting, and data exfiltration. This paper tries to establish that an intrusion detection system can recognize those phases from only 12 of the 77 network-flow features in the SCVIC-APT-2021 dataset, keeping the macro-average F1-score at 94%, recall at 93%, and accuracy at 100% on the test split the paper reports. The method ranks features with SHAP values from a trained XGBoost model and then runs a forward-selection loop that adds the top-ranked feature one at a time, keeping additions only while macro-F1 improves. The authors also claim the pipeline identifies the most influential features for each APT phase separately, which turns the detector into an explainable, phase-aware alarm rather than a single malicious/normal label. If the result holds, defenders get a lightweight model that trains faster, predicts faster, and indicates which network behaviors signal each stage of an attack.

What carries the argument

The engine is SHAP values feeding a forward-selection wrapper. SHAP (SHapley Additive exPlanations) decomposes each prediction into per-feature contributions using Shapley values from cooperative game theory; the paper uses the resulting importance list as a ranking. In the reported pipeline, the ranking is computed by training XGBoost and applying the SHAP explainer to the testing set. Algorithm 1 starts with an empty feature set, adds the highest-ranked SHAP feature, retrains the XGBoost classifier, and records the macro-averaged F1-score; it keeps adding features only while that score improves, stopping when no further gain occurs. The classifier itself is XGBoost with class weights computed from inverse class frequencies, which addresses the heavy imbalance in the dataset (normal traffic is about 98% of samples). XGBoost's tree structure makes SHAP computation fast, and macro-F1 keeps the selection criterion sensitive to the minority attack phases rather than to the majority class.

What would settle it

Run the same SHAP-ranked forward selection on SCVIC-APT-2021 with a three-way split, training on one part, validating on a second part for feature selection, and testing on a held-out part untouched by selection; if macro-F1 on the untouched test set falls materially below 94%, or below the 77-feature XGBoost baseline, the paper's central claim about the selected feature set's generalization is not supported.

Watch

Extended reading notes

Core claim

The paper's central claim is that a hybrid SHAP-XGBoost feature-selection procedure yields a minimal feature set that preserves the detection power of the full model. On SCVIC-APT-2021, the selected 12 features give macro-average F1-score 94%, recall 93%, precision 95%, and 100% accuracy on the reported test split, matching the 77-feature XGBoost on macro-F1 while cutting training time from 189.96 to 67.88 seconds on the authors' setup. The discovery is not just a smaller feature list: the SHAP analysis produces phase-specific rankings, so the model can indicate which features drive a reconnaissance or data-exfiltration decision. The paper shows the SHAP-based selection beats correlation-based, chi-square, ANOVA, and Lasso-based feature selection on the same dataset, and it compares favorably with earlier XGBoost-based models on the same benchmark, several of which used more features and reported lower macro-F1.

Load-bearing premise

The load-bearing premise is that the 20% test split used to compute SHAP values and to drive the forward-selection loop was not also the split on which the final macro-F1 was reported; if the same split served both purposes, the 94% figure is a fitted value rather than an unbiased estimate of how the 12-feature model will generalize to new traffic.

Editorial extensions

If this is right

  • A detector built from the 12 selected features can run with less memory and faster inference than a 77-feature model; the paper reports prediction time of 0.2799 seconds versus 0.3280 seconds and training time of 67.88 seconds versus 189.96 seconds on its hardware.
  • The model reports per-class F1-scores at or above 91% for all five APT phases (reconnaissance 91%, initial compromise 91%, lateral movement 91%, pivoting 97%, data exfiltration 92%), so reducing the feature set does not sacrifice minority-class detection.
  • Because SHAP analysis assigns features per phase, a security operator can trace a detection to a concrete signal, such as 'FWD Init Win Bytes' for reconnaissance or 'Packet Length Std' for data exfiltration, instead of receiving an opaque alert.
  • On the same dataset, the SHAP-based selection achieves macro-F1 94% versus 82% for chi-square and 84% for ANOVA when each method is limited to 12 features, and it also beats Lasso-based selection's 92%, so the choice of ranking method matters for the outcome.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the specific 12-feature list is probably less portable than the selection recipe; features like 'Idle Max' and 'FWD Init Win Bytes' reflect how SCVIC-APT-2021 was captured, so a deployment team would need to re-run the SHAP-ranked selection on its own network flows rather than importing the list unchanged.
  • Editorial inference: the phase-specific SHAP rankings suggest that TCP idle-time and packet-size statistics carry much of the signal separating normal traffic from early kill-chain activity, pointing toward cheap triage rules based on a few low-cost counters before a full model is invoked.
  • Editorial inference: a useful stress test would be to repeat the selection procedure on many random train/test splits of SCVIC-APT-2021, or on another APT dataset such as DAPT2020, and report the spread of selected features; if the 12 features change substantially across splits, the phase-attribution story is an artifact of one split rather than stable knowledge.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a feature-selection and classification pipeline for detecting APT phases in the SCVIC-APT-2021 dataset. The method trains an XGBoost classifier, computes SHAP values to rank features, and then uses forward selection over the SHAP ranking to choose a minimal feature subset, reporting a 12-feature model with 100% accuracy, 95% macro-precision, 93% macro-recall, and 94% macro-F1. The authors also provide per-phase SHAP feature analyses and compare against filter- and embedded-feature-selection methods and other ML baselines. The central claim is that this lightweight model improves detection performance while reducing feature count from 77 to 12.

Significance. If the quantitative claims were valid, a 12-feature multiclass IDS with phase-specific SHAP explanations would be a practically useful contribution: it would reduce computational cost, improve interpretability, and retain detection performance on a realistic APT benchmark. The paper has genuine strengths: it uses a current APT-specific dataset, provides per-phase feature-level explanations, and describes the selection algorithm explicitly. However, the evaluation design introduces a selection-on-test-set leak, and the paper's own comparison tables contradict the claimed improvement. As a result, the current contribution is mainly qualitative (the per-phase SHAP feature lists), and the headline quantitative result is not credible as reported.

major comments (4)
  1. [Section 5, Steps 2-3; Section 6.1; Algorithm 1] The reported macro-F1 is not an unbiased estimate of generalization because the same 20% test split is used for feature ranking, subset selection, and the final evaluation. Step 2 states that SHAP values are computed by analyzing the testing set, and Algorithm 1 iteratively adds top features while evaluating macro-F1 on the model trained with the candidate subset. Section 6.1 describes only an 80/20 train/test split and does not mention any separate validation set. Consequently, the 12-feature subset and the 94% F1 are fitted to the test split, so the headline number is optimistically biased and cannot support the abstract's generalization claim.
  2. [Table 7] Table 7 contradicts the abstract's assertion of improved performance. The proposed 12-feature XGBoost model achieves 94% macro-F1 and 95% macro-precision, identical to the 77-feature XGBoost model, while macro-recall drops from 94% to 93%. Thus the experimental results do not show that the proposed method improves detection performance; at best they show comparable performance with fewer features. The paper should either rephrase the claim as a complexity/interpretability trade-off or provide evidence of an actual performance gain.
  3. [Table 8] Table 8 omits a directly relevant baseline on the same dataset: reference [20] reports a macro-F1 of 95.20% for XGBoost on SCVIC-APT-2021, and this reference is cited earlier in Section 2. Adding this row would place the proposed 94% macro-F1 below an existing XGBoost result on the same data. The comparison is therefore incomplete and the claim that the proposed model outperforms other XGBoost-based studies is not supported by the table as presented.
  4. [Section 7.1, Table 5] The statement in Section 7.1 that 'the model distinguishes each class with 100% accuracy' is not supported by Table 5, which shows per-class recall values of 87-97% and per-class F1-scores of 91-97% for the minority classes. If the intended meaning is that overall accuracy is 100%, this should be stated precisely, and the relationship between the reported overall accuracy and the macro-averaged metrics should be clarified, especially in a highly imbalanced setting.
minor comments (4)
  1. [Table 6] The table header says 'Relevant 12 Features' for all methods, but the LR row lists 14 features. The comparison should be controlled for the number of features or the header should be adjusted, since feature-count differences affect both complexity and performance.
  2. [References; Table 8 title] Reference [10] is cited for SHAP but appears to be an incorrect or incomplete citation; the standard source is Lundberg and Lee, 'A Unified Approach to Interpreting Model Predictions' (NeurIPS 2017). The title of Table 8, 'Compression with XGBoost Algorithm in Other Studies,' appears to be a typo for 'Comparison.'
  3. [Section 6.1] The sentence describing the dataset contains a duplicated phrase: 'a holistic view of the interconnectedness of their interconnectedness.' This should be corrected.
  4. [Section 7.1] The phrase 'both the macro-average F1-score and recall reached 94% and 93%, respectively' in the abstract and conclusion is grammatically ambiguous; it should state that macro-F1 reached 94% and macro-recall reached 93%.

Circularity Check

1 steps flagged · score 6.0 of 10

Headline F1 is a selection-fitted number: the same 20% test split is used for SHAP ranking, forward feature selection, and the reported 94% macro-F1, so the central quantitative claim does not estimate generalization.

  1. fitted input called prediction [Section 5, Step 2, Step 3, Algorithm 1; Section 6.1 (data split)]
    "We then leverage the SHAP method on the explainer object to analyze the testing set, computing SHAP values for each data point to provide insights into the contribution of each feature to the model's predictions. After adding each feature, we evaluate the model's performance, specifically in terms of the macro-averaged F1-score ... We continue to iteratively add top features until there is no further improvement in the model's performance is observed. ... the dataset was split into two sets: 80% for training and 20%, ensuring the model could be evaluated on unseen data."

    The feature ranking (SHAP on the testing set) and the forward-selection loop (Algorithm 1) both operate on the same 20% split that later produces the reported 94% macro-F1. Section 6.1 describes only an 80/20 split, with no separate validation or nested evaluation. Thus the selected 12-feature subset and the reported F1 are the outcome of optimizing the evaluation metric on the evaluation data; calling the resulting number a prediction of how the 12-feature model performs on unseen data makes the 'prediction' statistically forced by its own selection input.

full rationale

The paper's core quantitative claim is that a 12-feature XGBoost model detects APT phases with 94% macro-F1 and 93% recall while improving on standard techniques. That claim reduces, in part, to a selection-fitted number: Step 2 computes SHAP importance on the testing set and Algorithm 1 chooses features by iteratively maximizing macro-F1, with no separate validation set described in Section 6.1. The reported macro-averaged F1 is therefore not an unbiased estimate of generalization; it is the optimized objective from the selection procedure. This is the central circular step, so the score is elevated. However, not all content is circular: the per-phase SHAP feature descriptions (Figures 3-5) are a qualitative contribution that does not depend on the leaked selection loop, and the paper's method description, aside from the evaluation split, is self-contained. I also note that even taking the numbers at face value, Table 7 shows the 12-feature model has the same 94% F1 and 95% precision as the 77-feature XGBoost baseline, with recall dropping from 94% to 93%, and Table 8 omits the 95.20% macro-F1 XGBoost result from related work [20] on the same dataset; these are consistency/oversight problems rather than circularity. No load-bearing self-citation chain was found: reference [5] is the authors' prior IDS comparison and is not used to justify the central result.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The empirical claims depend on the dataset, the static SHAP ordering, and the evaluation protocol. No new entities are introduced. The free parameters are hand-set hyperparameters and the test-fitted feature count.

free parameters (2)
  • XGBoost hyperparameters = n_estimators=100, learning_rate=0.3, max_depth=6
    Chosen without reported tuning; they directly shape all reported results (Table 2).
  • Feature subset size = 12
    Forward selection stops when macro-F1 does not improve, using the testing split for evaluation; the number is a fitted outcome, not a pre-specified hypothesis.
assumptions (3)
  • domain assumption SCVIC-APT-2021 is a valid, correctly labelled benchmark for APT phases.
    All conclusions rest on this dataset from [33]; the paper does not independently verify labels or real-world representativeness.
  • domain assumption SHAP feature ranking from the full-feature model remains a reliable ordering when features are dropped in forward selection.
    Algorithm 1 uses a static SHAP importance list from Step 2 and never recalibrates importance after removal, so ranking instability could invalidate the selected subset.
  • domain assumption Macro-averaged F1 with class weights is the right performance measure under extreme imbalance.
    With 98.3% normal traffic, the chosen metric and weighting scheme drive both selection and conclusions; deployment cost trade-offs are not modeled.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Explainable AI for Enhancing IDS Against Advanced Persistent Kill Chain." pith.science (2026). https://pith.science/paper/46G6KIO5

@misc{pith2026250607480,
  author       = {Pith},
  title        = {Pith review of: Explainable AI for Enhancing IDS Against Advanced Persistent Kill Chain},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/46G6KIO5}},
  note         = {Machine review of arXiv:2506.07480}
}
read the original abstract

Advanced Persistent Threats (APTs) represent a sophisticated and persistent cy-bersecurity challenge, characterized by stealthy, multi-phase, and targeted attacks aimed at compromising information systems over an extended period. Develop-ing an effective Intrusion Detection System (IDS) capable of detecting APTs at different phases relies on selecting network traffic features. However, not all of these features are directly related to the phases of APTs. Some network traffic features may be unrelated or have limited relevance to identifying malicious ac-tivity. Therefore, it is important to carefully select and analyze the most relevant features to improve the IDS performance. This work proposes a feature selection and classification model that integrates two prominent machine learning algo-rithms: SHapley Additive exPlanations (SHAP) and Extreme Gradient Boosting (XGBoost). The aim is to develop lightweight IDS based on a selected minimum number of influential features for detecting APTs at various phases. The pro-posed method also specifies the relevant features for each phase of APTs inde-pendently. Extensive experimental results on the SCVIC-APT-2021 dataset indi-cated that our proposed approach has improved performance compared to other standard techniques. Specifically, both the macro-average F1-score and recall reached 94% and 93 %, respectively, while reducing the complexity of the detec-tion model by selecting only 12 features out of 77.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

37 extracted references · 31 canonical work pages

  1. [20]

    A comprehensive comparison study of ML models for multistage APT detection: focus on data preprocessing and resampling,

    D. D. Dau, S. Lee, and H. Kim, “A comprehensive comparison study of ML models for multistage APT detection: focus on data preprocessing and resampling,” Journal of Supercomputing , vol. 80, no. 10, pp. 14143 –14179, 2024

    work page 2024

  2. [1]

    Strategically-motivated advanced persistent threat: Definition, process, tactics and a disinformation model of counterattack,

    A. Ahmad, J. Webb, K. C. Desouza, and J. Boorman, “Strategically-motivated advanced persistent threat: Definition, process, tactics and a disinformation model of counterattack,” Computers & Security, vol. 86, pp. 402–418, 2019

    work page 2019

  3. [2]

    Advanced persistent threat global market size 2015 -2028

    A. Borgeaud, “Advanced persistent threat global market size 2015 -2028.” https://www.statista.com/statistics/497945/advanced-persistent-threat-market- worldwide/ (accessed May 21, 2024)

    work page 2015

  4. [3]

    A Comprehensive Survey on Machine Learn ing-Based Intrusion Detection Systems for Secure Communication in Internet of Things,

    S. V. N. Santhosh Kumar, M. Selvi, and A. Kannan, “A Comprehensive Survey on Machine Learn ing-Based Intrusion Detection Systems for Secure Communication in Internet of Things,” Computational Intelligence and Neuroscience, vol. 2023, pp. 1–24, 2023, doi: 10.1155/2023/8981988

    work page doi:10.1155/2023/8981988 2023

  5. [4]

    Comparative Analysis of Int rusion Detection Systems and Machine Learning -Based Model Analysis Through Decision Tree,

    Z. Azam, M. M. Islam, and M. N. Huda, “Comparative Analysis of Int rusion Detection Systems and Machine Learning -Based Model Analysis Through Decision Tree,” IEEE Access, vol. 11, no. August, pp. 80348–80391, 2023, doi: 10.1109/ACCESS.2023.3296444

    arXiv 2023

  6. [5]

    A Comparative Study of IDS-Based Deep Learning Models for IoT Network,

    B. N. Shaker, B. Q. Al -Musawi, and M. F. Hassan, “A Comparative Study of IDS-Based Deep Learning Models for IoT Network,” in ACM International Conference Proceeding Series , 2023, vol. 1, no. 1, pp. 15 –21. doi: 10.1145/3603273.3635058

    work page arXiv 2023

  7. [6]

    Integrated Feature -Based Network Intrusion Detection System Using Incremental Feature Generation,

    T. Kim and W. Pak, “Integrated Feature -Based Network Intrusion Detection System Using Incremental Feature Generation,” Electronics, vol. 12, p. 1657, 2023

    work page 2023

  8. [7]

    APT datasets and attack modeling for automated detection methods: A review,

    B. Stojanović, K. Hofer -Schmitz, and U. Kleb, “APT datasets and attack modeling for automated detection methods: A review,” Computers and Security, vol. 92, p. 101734, 2020

    work page 2020

Show all 37 references
  1. [8]

    Feature selection and ensemble -based intrusion detection system: an efficient and comprehensive approach,

    X. Jaw, Ebrima and Wang, “Feature selection and ensemble -based intrusion detection system: an efficient and comprehensive approach,” Symmetry, vol. 13, p. 1764, 2021

    2021

  2. [9]

    Survey of feature selection and extraction techniques for stock market prediction,

    H. H. Htun, M. Biehl, and N. Petkov, “Survey of feature selection and extraction techniques for stock market prediction,” Financial Innovation, vol. 9, no. 1, 2023

    2023

  3. [10]

    A Unified Approach to Interpreting Model Predictions Scott,

    K. Zhang, Y. Zhang, and M. Wang, “A Unified Approach to Interpreting Model Predictions Scott,” Advances in neural information processing systems, vol. 16, no. 3, pp. 426–430, 2017

    2017

  4. [11]

    Evaluating Standard Feature Sets Towards Increased Generalisability and Explainability of ML -Based Network Intrusion Detection,

    M. Sarhan, S. Layeghy, and M. Portmann, “Evaluating Standard Feature Sets Towards Increased Generalisability and Explainability of ML -Based Network Intrusion Detection,” Big Data Research, vol. 30, pp. 1–12, 2022

    2022

  5. [12]

    Early detection of the advanced persistent threat attack using performance analysis of deep learning,

    J. H. Joloudari, M. Haderbadi, A. Mashmool, M. Ghasemigol, S. S. Band, and A. Mosavi, “Early detection of the advanced persistent threat attack using performance analysis of deep learning,” IEEE Access , vol. 8, pp. 186125 – 186137, 2020

    2020

  6. [13]

    A Study on NSL -KDD Dataset for Intrusion Detection System Based on Classification Algorithms,

    L. Dhanabal and S. P. Shantharajah, “ A Study on NSL -KDD Dataset for Intrusion Detection System Based on Classification Algorithms,” International Journal of Advanced Research in Computer and Communication Engineering, vol. 4, no. 6, pp. 446–452, 2015

    2015

  7. [14]

    Discovering unknown advanced persistent threat using shared features mined by neural networks,

    L. Shang, D. Guo, Y. Ji, and Q. Li, “Discovering unknown advanced persistent threat using shared features mined by neural networks,” Computer Networks, vol. 189, no. February, 2021

    2021

  8. [15]

    Feature analysis for data - driven APT -related malware discrimination,

    L. F. Martín Liras, A. R. de Soto, and M. A. Prada, “Feature analysis for data - driven APT -related malware discrimination,” Computers and Security , vol. 104, 2021

    2021

  9. [16]

    Securing Critical Infrastructures : Deep Learning -based Threat Detection in the IIoT,

    K. Yu et al., “Securing Critical Infrastructures : Deep Learning -based Threat Detection in the IIoT,” vol. 59, pp. 76–82, 2021

    2021

  10. [17]

    A novel approach for APT attack detection based on combined deep learning model,

    C. Do Xuan and M. H. Dao, “A novel approach for APT attack detection based on combined deep learning model,” Neural Computing and Applications , vol. 33, no. 20, pp. 13251–13264, 2021, doi: 10.1007/s00521-021-05952-5

    2021 doi

  11. [18]

    An Intell igent System to Detect Advanced Persistent Threats in Industrial Internet of Things (I-IoT),

    S. H. Javed, M. Bin Ahmad, M. Asif, S. H. Almotiri, K. Masood, and M. A. Al Ghamdi, “An Intell igent System to Detect Advanced Persistent Threats in Industrial Internet of Things (I-IoT),” Electronics (Switzerland), vol. 11, no. 5, pp. 1–25, 2022

    2022

  12. [19]

    APT Adversarial Defence Mechanism for Industrial IoT Enabled Cyber-Physical System,

    S. H. Javed et al., “APT Adversarial Defence Mechanism for Industrial IoT Enabled Cyber-Physical System,” IEEE Access, vol. 11, no. June, pp. 74000 – 74020, 2023, doi: 10.1109/ACCESS.2023.3291599

    2023

  13. [21]

    A survey on advanced persistent threats: Techniques, solutions, challenges, and research opportunities,

    A. Alshamrani, S. Myneni, A. Chowdhary, and D. Huang, “A survey on advanced persistent threats: Techniques, solutions, challenges, and research opportunities,” IEEE Communications Surve ys & Tutorials, vol. PP, no. 8, p. 1, 2019

    2019

  14. [22]

    Challenges in resource -constrained iot devices: Energy and communication as critical success factors for future iot deployment,

    F. Pereira, R. Correia, P. Pinho, S. I. Lopes, and N. B. Carvalho, “Challenges in resource -constrained iot devices: Energy and communication as critical success factors for future iot deployment,” Sensors, vol. 20, no. 22, pp. 1 –30, 2020

    2020

  15. [23]

    Steffens, Attribution of Advanced Persistent Threats

    T. Steffens, Attribution of Advanced Persistent Threats. Springer, 2020

    2020

  16. [24]

    XGBoost: A scalable tree boosting system,

    T. Chen and C. Guestrin, “XGBoost: A scalable tree boosting system,” Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 785–794, 2016

    2016

  17. [25]

    Effective intrusion detection system using XGBoost,

    S. S. Dhaliwal, A. Al Nahid, and R. Abbas, “Effective intrusion detection system using XGBoost,” Information (Switzerland) , vol. 9, no. 7, 2018, doi: 10.3390/info9070149

    2018 doi

  18. [26]

    Feature selection methods simultaneously improve the detection accuracy and model building time of machine learning classifiers,

    S. Alabdulwahab and B. K. Moon, “Feature selection methods simultaneously improve the detection accuracy and model building time of machine learning classifiers,” Symmetry, vol. 12, no. 9, 2020, doi: 10.3390/SYM12091424

    2020 doi

  19. [27]

    Building an effic ient intrusion detection system based on feature selection and ensemble classifier,

    Y. Zhou, G. Cheng, S. Jiang, and M. Dai, “Building an effic ient intrusion detection system based on feature selection and ensemble classifier,” Computer Networks, vol. 174, 2020, doi: 10.1016/j.comnet.2020.107247

    2020

  20. [28]

    Comparative Analysis of XGBoost Performance for Text Classification with CPU Parallel and Non - Parallel Processing,

    O. Ahmed Al -Zakhali, S. Zeebaree, and S. Askar, “Comparative Analysis of XGBoost Performance for Text Classification with CPU Parallel and Non - Parallel Processing,” Indonesian Journal of Computer Science , vol. 13, no. 2, 2024, doi: 10.33022/ijcs.v13i2.3798

    2024 doi

  21. [29]

    XGBoost: A scalable tree boosting system,

    T. Chen and C. Guestrin, “XGBoost: A scalable tree boosting system,” Proceedings of the A CM SIGKDD International Conference on Knowledge Discovery and Data Mining , vol. 13 -17-Augu, pp. 785 –794, 2016, doi: 10.1145/2939672.2939785

    2016

  22. [30]

    A new intrusion detection system based on using non -linear statistical analysis and features selection techniques,

    A. Al-Bakaa and B. Al -Musawi, “A new intrusion detection system based on using non -linear statistical analysis and features selection techniques,” Computers and Security , vol. 122, no. November, 2022, doi: 10.1016/j.cose.2022.102906

    2022

  23. [31]

    Optimizing filter -based feature selection method flow for intrusion detection system,

    M. A. Siddiqi and W. Pak, “Optimizing filter -based feature selection method flow for intrusion detection system,” Electronics, vol. 9, no. 12, pp. 1–18, 2020

    2020

  24. [32]

    Feature selection methods: Case of filter and wrapper approaches for maximising classification accuracy,

    Y. B. Wah, N. Ibrahim, H. A. Hamid, S. Abdul-Rahman, and S. Fong, “Feature selection methods: Case of filter and wrapper approaches for maximising classification accuracy,” Pertanika Journal of Science and Technology, vol. 26, no. 1, pp. 329–340, 2018

    2018

  25. [33]

    A new realistic benchmark for advanced persistent threats in network traffic,

    J. Liu et al. , “A new realistic benchmark for advanced persistent threats in network traffic,” IEEE Networking Letters, vol. 4, no. 3, pp. 162–166, 2022

    2022

  26. [34]

    XGBoost for Imbala nced Multiclass Classification-Based Industrial Internet of Things Intrusion Detection Systems,

    T. T. H. Le, Y. E. Oktian, and H. Kim, “XGBoost for Imbala nced Multiclass Classification-Based Industrial Internet of Things Intrusion Detection Systems,” Sustainability (Switzerland) , vol. 14, no. 14, pp. 1 –21, 2022, doi: 10.3390/su14148707

    2022 doi

  27. [35]

    Evaluation metrics for intrusion detection systems-a study,

    G. Kumar Ahuja and G. Kumar, “Evaluation metrics for intrusion detection systems-a study,” Evaluation, vol. 2, no. 11, pp. 11–17, 2014

    2014

  28. [36]

    Prior Knowledge based Advanced Persiste nt Threats Detection for IoT in a Realistic Benchmark,

    Y. Shen, M. Simsek, B. Kantarci, H. T. Mouftah, M. Bagheri, and P. Djukic, “Prior Knowledge based Advanced Persiste nt Threats Detection for IoT in a Realistic Benchmark,” in GLOBECOM 2022 IEEE Global Communications Conference, 2022, pp. 3551–3556

    2022

  29. [37]

    Advanced Persistent Threat Identification with Boosting and Explainable AI,

    M. M. Hasan, M. U. Islam, and J. Uddin, “Advanced Persistent Threat Identification with Boosting and Explainable AI,” SN Computer Science , vol. 4, no. 3, pp. 1–9, 2023

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.