Pith. sign in

REVIEW 4 major objections 5 minor 77 references

Feature Selection for Network Intrusion Detection

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that features with zero estimated transfer entropy to the attack label can be removed one by one, leaving a subset that preserves the same information-theoretic accuracy bound as the full feature set.

desk verdict FSNID is a promising feature-selection method with a decent empirical story, but the theoretical guarantee doesn't cover the implemented threshold, and the appendix proofs are shaky. read the letter →

arxiv 2411.11603 v1 pith:XEUF5KBR submitted 2024-11-18 cs.LG cs.CR

Charles Westphal , Stephen Hailes , Mirco Musolesi This is my paper · ORCID
classification cs.LGcs.CR
keywords featureselectionnetworkintrusiondetectiontransferentropymutualinformationneuralestimationrecurrenttheoryredundancyandsynergysecurityclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper presents FSNID, a filter method that chooses which network features to keep for intrusion detection by measuring how much each feature reduces uncertainty about whether traffic is an attack. The central claim is that features adding zero conditional mutual information can be removed one at a time, and the selected subset preserves the same information-theoretic bound on classification accuracy as the full feature set. The authors prove this preservation claim as Theorem 1 and support it experimentally on five public NID datasets, where the selected subset is much smaller while accuracy, F1, and false-positive rates stay close to full-feature classifiers. A recurrent version of the estimator also folds temporal dependencies into the selection step, so time-correlated attack patterns are not lost when features are dropped.

What carries the argument

The central object is the transfer-entropy measure $\Phi_{X_i;\,X\to Y}=H(Y|X\setminus X_i)-H(Y|X)$, estimated as the difference of two neural mutual-information estimates built on the Donsker-Varadhan representation. The vanishing condition $\Phi=0$ identifies features that do not reduce uncertainty about $Y$; Algorithm 1 evaluates each feature once, removes it if $\Phi=0$, and thus handles correlated and redundant features while setting the final feature count automatically. For temporal data, the estimator takes sequences of length $s$ and uses an LSTM, so the importance score reflects information carried across time rather than within a single snapshot.

What would settle it

Run the $\Phi$ estimator many times on a dataset with a known-irrelevant shuffled feature and plot the distribution of estimated values; a visibly non-normal or heavy-tailed distribution means the 95% threshold will select a different set than intended. A direct test of the theorem is to estimate $H(Y|X^*)$ and $H(Y|X)$ on held-out data and check whether they are equal or whether the selected subset loses information.

Watch

Extended reading notes

Core claim

The paper's central discovery is that the drop in conditional entropy of the attack label when a feature is added back to the remaining set, written $\Phi_{X_i;\,X\to Y}=H(Y|X\setminus X_i)-H(Y|X)$, is a sound basis for greedy feature removal in NID. Features with $\Phi=0$ are classified as irrelevant, redundant, or perfectly redundant, and the paper argues that sequential removal handles the perfectly redundant case so that the final set $X^*$ satisfies $H(Y|X)=H(Y|X^*)$. Consequently, by known information-theoretic bounds on classification, a classifier trained on $X^*$ has the same theoretical accuracy ceiling as one trained on all features. In experiments, FSNID retains far fewer features than baselines, and the LSTM version retains fewer still, with comparable classification performance.

Load-bearing premise

The selection threshold assumes the estimated transfer-entropy values for both the noise variable and the real features are normally distributed, so a fixed 95% statistical test separates informative from uninformative features.

Editorial extensions

If this is right

  • If $H(Y|X)=H(Y|X^*)$ holds, any classifier trained only on the selected features inherits the full-feature-set accuracy bound, so the selection step does not cap detection performance.
  • The method requires no preset feature count, solving the length-$k$ problem in a single linear pass over the features.
  • Because only features with zero estimated transfer entropy are dropped, synergistic features—those useful only in combination—are protected by the sequential evaluation.
  • The LSTM variant can reduce the feature set further on time-dependent attack traffic, since temporal information is included in the importance score.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct extension is to apply the same sequential $\Phi=0$ rule to other high-dimensional classification problems, but the normality assumption on estimated scores would need to be re-validated in each new domain.
  • If the neural estimates are biased so that the ordering of small positive $\Phi$ values is unstable, the selected set could silently drop weakly informative features; running selection over multiple random seeds and measuring the stability of $X^*$ would test this.
  • The identity $H(Y|X)=H(Y|X^*)$ is an information-theoretic statement, not a guarantee for a specific classifier, so in practice finite-sample behaviour will also depend on the model's inductive bias.
  • The per-feature information value could be reused for active data acquisition, deciding which network measurements to collect next rather than only which to keep.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces FSNID, a filter-based feature selection method for network intrusion detection. The method defines a transfer-entropy-like measure Φ_{X_i;X→Y} = H(Y|X\{X_i}) − H(Y|X), estimates it by subtracting two neural mutual-information estimates (based on MINE), and removes features for which this estimate is judged statistically indistinguishable from zero using a null model and a 95% Neyman-Pearson rule. A sequential variant (Algorithm 1) is designed to handle redundant features, and a temporal version replaces the feedforward estimator with an LSTM, GRU, or TCN. The paper includes a theoretical guarantee (Appendix B) that exact application of Algorithm 1 preserves H(Y|X) = H(Y|X*), and an empirical study on five public NID datasets comparing against PI, LASSO, UMFI, MIFA, CLM, and a random baseline. The experiments report reduced feature counts with accuracy, F1, and false-positive rates close to the full-feature classifiers, plus a scalability experiment showing near-linear runtime in the number of features.

Significance. If the information-preservation claim held for the implemented estimation procedure, FSNID would be a practically valuable contribution: it is a filter method with linear complexity, no preset number of features k, a native treatment of redundancy, and an optional recurrent extension that exploits temporal dependencies. The empirical scope is a strength: five public datasets, six baselines, a random-selection control, and 95% confidence intervals for classification metrics. However, the central theoretical guarantee applies only to exact computation of Φ, while the deployed decision rule replaces the exact condition Φ=0 with an unvalidated statistical threshold on noisy neural estimates. The experimental claim of 'maintaining NID performance' is supported only by point comparisons and overlapping confidence intervals, not by equivalence testing, and the feature-retention results are reported without confidence intervals. These gaps leave the main claims weaker than the abstract suggests.

major comments (4)
  1. [4.7, Appendix B] The implemented FSNID rule is not the exact condition Φ_{X_i;X→Y}=0 that Theorem 1 analyzes. Section 4.7 replaces that condition with a 95% Neyman-Pearson test that assumes both the null model NM and the feature Φ estimates are normally distributed. The paper provides no normality check, no bias or variance analysis of the MINE-based estimate in Eq. (6), and no account of how the rule behaves when many features have small but nonzero Φ. Under such a rule, the per-feature test can remove individually negligible features whose cumulative conditional information is substantial, so the conclusion H(Y|X)=H(Y|X*) of Theorem 1 does not transfer to the implemented algorithm. This directly affects the central 'maintaining NID performance' claim, and the threshold needs validation (e.g., calibration plots, bootstrap intervals, or a sensitivity analysis) before the information-preservation claim can be attributed to FSNID as deployed.
  2. [5.3.1, Figure 2] The top row of Figure 2 reports the fraction of features retained by each method, but these are point estimates only. The paper states that Φ and classification results are obtained over 5 runs, yet no confidence intervals, standard deviations, or significance tests are reported for the feature-count reduction. The abstract's claim that FSNID 'selects a significantly reduced feature set' therefore lacks statistical support; the word 'significantly' is not backed by any test. The authors should report the distribution of selected feature counts across runs and test whether the reduction relative to each baseline is meaningful given the variability of the MINE estimates.
  3. [5.3.2] The claim that FSNID 'maintains NID performance' is supported by showing that accuracy, F1, and false-positive values fall within overlapping confidence intervals with the full-feature classifier. Overlapping intervals are not evidence of equivalence. An equivalence test (e.g., two one-sided tests) or at least a non-inferiority analysis is needed to substantiate the performance-maintenance claim for RQ1. Without this, the empirical conclusion is only that no large degradation was observed on these datasets, which is weaker than the abstract's claim.
  4. [Appendix B, Theorem 1 proof] The proof of Theorem 1 contains a direction error in the inequality chain in Eq. (18). From monotonicity of conditional entropy, for a superset relation one obtains H(Y|X) ≤ H(Y|X\X_j) ≤ H(Y|X_i), not H(Y|X\X_j) ≤ H(Y|X_i) ≤ H(Y|X) as written. The conclusion can likely be repaired in the specific perfect-redundancy case because the definition gives H(Y|X)=H(Y|X_i), but the proof as printed is incorrect. In addition, Lemma 3's proof relies on an ill-defined 'monotonicity of conditional entropy' applied to the intersection of sets; the relationship between Lemma 3 (which says perfectly redundant variables cannot be removed) and Theorem 1 (which says the sequential algorithm removes them without loss) should be clarified, since as written Lemma 3 appears to contradict the theorem's conclusion.
minor comments (5)
  1. [1] The word 'portrey' in Section 1 should be 'portray'.
  2. [References] Reference [16], attributed to Dorothy Denning, appears to have an incorrect title ('Algorithmic Enumeration of Ideal Classes for Quaternion Orders'); the intended citation is likely Denning's 'An Intrusion-Detection Model' (1987).
  3. [Appendix F] The stopping rule for MIFA is under-specified: the paper says features are added from k=5 in increments of 5 until the next set does not give a statistically significant improvement in MI, but it does not state which statistical test is used or how multiple comparisons are handled, which is important for a fair baseline comparison.
  4. [Figure 2] The top-row y-axis label reads '% Features Retained' but the axis values run from 0 to 1 (or 0.0 to 0.8), which suggests the plotted quantity is a fraction, not a percentage; the axis label and units should be made consistent.
  5. [Appendix B] In the Theorem 1 proof, the measure is written as Φ_{X_j;X→A} in several places, while the main text uses Φ_{X_i;X→Y}; the symbol A is not defined in that context (elsewhere A(X) denotes the set of realizations of X), so this is a notational inconsistency that should be corrected.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: FSNID's information-preservation guarantee is a mathematical consequence of its filter rule, and the empirical performance claims are assessed against full features, external baselines, and random controls.

full rationale

No significant circularity was found. The central measure Phi_{Xi;X->Y} is defined as H(Y|X\Xi) - H(Y|X) (Eq. 3) and is independently estimated as the difference of two MINE-based MI estimates (Eqs. 4-6), rather than being fitted to the classification outcomes. Algorithm 1 removes features for which this measure is zero; Theorem 1's conclusion H(Y|X) = H(Y|X*) is a mathematical consequence of that removal rule and the non-negativity of Phi, and it does not assume the empirical 'maintaining NID performance' result. The empirical claim is tested against the full feature set, five external baselines, and a random-feature control on five public datasets, so the performance outcome is not an input to the selection rule. The normality assumption in Section 4.7 and the lack of bias/variance analysis for the neural estimates are robustness concerns, not circularity; they affect whether the implemented threshold matches the exact Phi=0 condition, but they do not make the derivation equivalent to its inputs. The paper contains no load-bearing self-citations: references [5], [52], and [69] are external, and the null-model procedure is explicitly attributed to [69] rather than to the authors' own prior work.

Assumptions & free parameters 3 free parameters · 5 assumptions · 1 invented entities

Selection depends on a hand-set significance level, an unvalidated normality assumption, and the reliability of neural MI estimates; the theoretical guarantees apply to exact zero transfer entropy and do not formally cover the noisy thresholding rule.

free parameters (3)
  • Null model significance level alpha = 0.05
    Hand-set in Section 4.7 via Neyman-Pearson; directly controls how many features are retained. Not estimated from data.
  • Sequence length s = 10
    Set in Appendix H for LSTM/GRU/TCN variants; determines the temporal window used in MI estimation and affects selected features.
  • MINE training budget (iterations N, batch b) = N=10000 vanilla, N=20000 LSTM; b=100
    Training budget for neural MI estimators (Appendix H); influences estimate quality and threshold outcomes.
assumptions (5)
  • standard math Shannon entropy, MI identities, and the Donsker-Varadhan representation (Eq. 5) from Belghazi et al. [5] are valid.
    The measure Φ and its neural estimation rely on these established results.
  • domain assumption Network data are sampled from a stable joint distribution over features and labels.
    NID classification and MI estimation assume the empirical distribution represents operating conditions.
  • domain assumption MINE-based estimates of Φ are accurate enough that their ordering and magnitudes support the threshold decision.
    Selection thresholds noisy difference estimates; no error bounds or validation are provided.
  • ad hoc to paper The null model and feature Φ estimates follow normal distributions.
    Stated in Section 4.7; justifies the fixed 95% rule but is never tested.
  • ad hoc to paper The exact-zero guarantees of Appendix B carry over to the statistical thresholding procedure.
    The proofs assume exact Φ=0; the algorithm uses an approximate 95% test on noisy estimates.
invented entities (1)
  • Null model random variable NM
    purpose: Inserted into the feature set to estimate a null distribution for Φ under the hypothesis of no information transfer.
    A statistical control, not a physical postulate; its assumed zero transfer entropy and normality are untested.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Feature Selection for Network Intrusion Detection." pith.science (2026). https://pith.science/paper/XEUF5KBR

@misc{pith2026241111603,
  author       = {Pith},
  title        = {Pith review of: Feature Selection for Network Intrusion Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XEUF5KBR}},
  note         = {Machine review of arXiv:2411.11603}
}
read the original abstract

Network Intrusion Detection (NID) remains a key area of research within the information security community, while also being relevant to Machine Learning (ML) practitioners. The latter generally aim to detect attacks using network features, which have been extracted from raw network data typically using dimensionality reduction methods, such as principal component analysis (PCA). However, PCA is not able to assess the relevance of features for the task at hand. Consequently, the features available are of varying quality, with some being entirely non-informative. From this, two major drawbacks arise. Firstly, trained and deployed models have to process large amounts of unnecessary data, therefore draining potentially costly resources. Secondly, the noise caused by the presence of irrelevant features can, in some cases, impede a model's ability to detect an attack. In order to deal with these challenges, we present Feature Selection for Network Intrusion Detection (FSNID) a novel information-theoretic method that facilitates the exclusion of non-informative features when detecting network intrusions. The proposed method is based on function approximation using a neural network, which enables a version of our approach that incorporates a recurrent layer. Consequently, this version uniquely enables the integration of temporal dependencies. Through an extensive set of experiments, we demonstrate that the proposed method selects a significantly reduced feature set, while maintaining NID performance. Code will be made available upon publication.

Figures

Figures reproduced from arXiv: 2411.11603 by the authors.

Figure 1
Figure 1. Diagrammatic representation of FSNID. relationships: 𝐼(X𝑡−𝑠:𝑡 ;𝑌 𝑡−𝑠:𝑡 ) = sup 𝐿:𝐴(X𝑡−𝑠:𝑡 )×𝐴(𝑌𝑡−𝑠:𝑡 ) ↦→R E𝑃X𝑡−𝑠:𝑡 ,𝑌𝑡−𝑠:𝑡 [𝐿(X𝑡−𝑠:𝑡 , 𝑌𝑡−𝑠:𝑡 )] − log E𝑃X𝑡−𝑠:𝑡 ,𝑃𝑌𝑡−𝑠:𝑡 [𝑒 𝐿(X𝑡−𝑠:𝑡 ,𝑌𝑡−𝑠:𝑡 ) ]. (7) The function 𝐿(·) is again the output of a neural function ap￾proximator, where now the input is the variables X𝑡−𝑠:𝑡 and 𝑌 𝑡−𝑠:𝑡 . Each variable is sampled as chronologically ordered sequences of size 𝑠. These are then … view at source ↗
Figure 2
Figure 2. Comparison of the vanilla (red bars) and LSTM-based (pink bars) versions of FSNID to PI (green bars), UMFI (blue [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Performance comparison of FSNID against the chosen baselines in terms of their ability to deal with highly correlated [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Temporal complexity of FSNID and comparators [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: In this figure we compare three neural architectures ability to incorporate temporal dependencies into the feature [PITH_FULL_IMAGE:figures/full_fig_p014_5.png]
Figure 6
Figure 6. Figure 6: In this figure we report the results of FSNID and baselines when applied to the Bot-IoT dataset. [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

77 extracted references · 73 canonical work pages

  1. [1]

    Mohiuddin Ahmed, Abdun Naser Mahmood, and Jiankun Hu. 2016. A survey of network anomaly detection techniques. Journal of Network and Computer Applications 60, 3 (2016), 19–31

    work page 2016

  2. [2]

    Ahmed Ahmim, Leandros Maglaras, Mohamed Amine Ferrag, Makhlouf Derdour, and Helge Janicke. 2019. A novel hierarchical intrusion detection system based on decision tree and rules-based models. In 19th International Conference on Distributed Computing in Sensor Systems (DCOSS’19) . IEEE, 228–233

    work page 2019

  3. [3]

    Fatemeh Amiri, MohammadMahdi Rezaei Yousefi, Caro Lucas, Azadeh Shakery, and Nasser Yazdani. 2011. Mutual information-based feature selection for in- trusion detection systems. Journal of Network and Computer Applications 34, 4 (2011), 1184–1199

    work page 2011

  4. [4]

    R. Battiti. 1994. Using mutual information for selecting features in supervised neural net learning. IEEE Transactions on Neural Networks 5, 4 (1994), 537–550

    work page 1994

  5. [5]

    Ishmael Belghazi, Sai Rajeswar, Aristide Baratin, R Devon Hjelm, and Aaron Courville. 2018. MINE: Mutual Information Neural Estimation. In 19th Interna- tional Conference on Machine Learning (ICML’18) . PMLR, 531–540

    work page 2018

  6. [6]

    Hamid Bostani and Mansour Sheikhan. 2017. Hybrid of binary gravitational search algorithm and mutual information for feature selection in intrusion detec- tion systems. Soft Computing 21 (2017), 2307–2324

    work page 2017

  7. [7]

    Leo Breiman. 2001. Random forests. Machine Learning 45, 1 (2001), 5–32

    2001

  8. [8]

    Gavin Brown, Adam Pocock, Ming-Jie Zhao, and Mikel Luján. 2012. Conditional Likelihood Maximisation: A Unifying Framework for Information Theoretic Feature Selection. Journal of Machine Learning Research 13, 2 (2012), 27–66

    work page 2012

Show all 77 references
  1. [9]

    Amnon Catav, Boyang Fu, Yazeed Zoabi, Ahuva Libi Weiss Meilik, Noam Shom- ron, Jason Ernst, Sriram Sankararaman, and Ran Gilad-Bachrach. 2021. Marginal Contribution Feature Importance - an Axiomatic Approach for Explaining Data. In 19th International Conference on Machine Lear...

    2021

  2. [10]

    Jinfu Chen, Yuhao Chen, Saihua Cai, Shang Yin, Lingling Zhao, and Zikang Zhang. 2023. An optimized feature extraction algorithm for abnormal network traffic detection. Future Generation Computer Systems 149, 1 (2023), 330–342

    2023

  3. [11]

    Jianbo Chen, Le Song, Martin Wainwright, and Michael Jordan. 2018. Learning to explain: An information-theoretic perspective on model interpretation. In19th International Conference on Machine Learning (ICML’18) . PMLR, 883–892

    2018

  4. [12]

    Te-Shun Chou, Kang K Yen, and Jun Luo. 2008. Network intrusion detection design using feature selection of soft computing paradigms. International Journal of Computer and Information Engineering 2, 11 (2008), 3722–3734

    2008

  5. [13]

    Covert, Scott Lundberg, and Su-In Lee

    Ian C. Covert, Scott Lundberg, and Su-In Lee. 2020. Understanding Global Feature Contributions with Additive Importance Measures. In 34th Annual Conference on Neural Information Processing Systems (NeurIPS’20) . 17212–17223

    2020

  6. [14]

    Ian Connick Covert, Wei Qiu, Mingyu Lu, Na Yoon Kim, Nathan J White, and Su-In Lee. 2023. Learning to Maximize Mutual Information for Dynamic Feature Selection. In 40th International Conference on Machine Learning (ICML’23) . PMLR, 6424–6447

    2023

  7. [15]

    Dries Debeer and Carolin Strobl. 2020. Conditional permutation importance revisited. BMC Bioinformatics 21, 1 (07 2020), 1–30

    2020

  8. [16]

    Dorothy Denning. 1987. Algorithmic Enumeration of Ideal Classes for Quaternion Orders. IEEE Transactions on Software Engineering 12, 2 (1987), 222–232

    1987

  9. [17]

    Nicolas Dobigeon, Jean-Yves Tourneret, and Manuel Davy. 2007. Joint segmen- tation of piecewise constant autoregressive processes by using a hierarchical model and a Bayesian sampling approach. IEEE Transactions on Signal Processing 55, 4 (2007), 1251–1263

    2007

  10. [18]

    Jerome Friedman, Trevor Hastie, and Rob Tibshirani. 2010. Regularization paths for generalized linear models via coordinate descent.Journal of statistical software 33, 1 (2010), 1

    2010

  11. [19]

    Christopher Frye, Colin Rowat, and Ilya Feige. 2020. Asymmetric Shapley Values: Incorporating Causal Knowledge into Model-Agnostic Explainability. In 34th Annual Conference on Neural Information Processing Systems (NeurIPS’20) . 1229– 1239

    2020

  12. [20]

    Shuyang Gao, Greg Ver Steeg, and Aram Galstyan. 2016. Variational Informa- tion Maximization for Feature Selection. In 30th Annual Conference on Neural Information Processing Sytems (NeurIPS’16) , D. Lee, M. Sugiyama, U. Luxburg, I. Guyon, and R. Garnett (Eds.). 1285–1312

    2016

  13. [21]

    Baptiste Gregorutti, Bertrand Michel, and Philippe Saint-Pierre. 2017. Correlation and variable importance in random forests. Statistics and Computing 27 (2017), 659–678

    2017

  14. [22]

    Flore Harle, Florent Chatelain, Cedric Gouy-Pailler, and Sophie Achard. 2014. Rank-based multiple change-point detection in multivariate time series. In 2014 22nd European Signal Processing Conference (EUSIPCO’14) . IEEE, 1337–1341

    2014

  15. [23]

    Sepp Hochreiter and Jürgen Schmidhuber. 1997. Long short-term memory.Neural Computation 9, 8 (1997), 1735–1780

    1997

  16. [24]

    IBM. 2023. Cost of a Data Breach Report 2023. https://www.ibm.com/reports/ data-breach

    2023

  17. [25]

    Ja Jabez and B Muthukumar. 2015. Intrusion Detection System (IDS): Anomaly detection using outlier detection approach. Procedia Computer Science 48 (2015), 338–346

    2015

  18. [26]

    Joseph Janssen, Vincent Guan, and Elina Robeva. 2023. Ultra-marginal Feature Importance: Learning from Data with Causal Guarantees. In 26th International Conference on Artificial Intelligence and Statistics (AISTATS’23) . PMLR, 10782– 10814

    2023

  19. [27]

    Dominik Janzing, Lenon Minorics, and Patrick Bloebaum. 2020. Feature rele- vance quantification in explainable AI: A causal problem. In 23rd International Conference of Artificial Intelligence and Statistics (AISTATS’20). PMLR, 2907–2916

    2020

  20. [28]

    Ahmad Javaid, Quamar Niyaz, Weiqing Sun, and Mansoor Alam. 2016. A deep learning approach for network intrusion detection system. EAI, 21–26

    2016

  21. [29]

    Yang Jia, Meng Wang, and Yagang Wang. 2019. Network intrusion detection algorithm based on deep neural network. IET Information Security 13, 1 (2019), 48–53

    2019

  22. [30]

    Kaiyuan Jiang, Wenya Wang, Aili Wang, and Haibin Wu. 2020. Network intrusion detection combined hybrid sampling with deep hierarchical network.IEEE Access 8 (2020), 32464–32476

    2020

  23. [31]

    Gozde Karatas, Onder Demir, and Ozgur Koray Sahingoz. 2020. Increasing the Performance of Machine Learning-Based IDSs on an Imbalanced and Up-to-Date Dataset. IEEE Access 8 (2020), 32150–32162

    2020

  24. [32]

    Jasmin Kevric, Samed Jukic, and Abdulhamit Subasi. 2017. An effective combining classifier approach using tree algorithms for network intrusion detection. Neural Computing and Applications 28, 1 (2017), 1051–1058

    2017

  25. [33]

    Chaouki Khammassi and Saoussen Krichen. 2017. A GA-LR wrapper approach for feature selection in network intrusion detection. Computers & Security 70 (2017), 255–277

    2017

  26. [34]

    Chaouki Khammassi and Saoussen Krichen. 2020. A NSGA2-LR wrapper ap- proach for feature selection in network intrusion detection. Computer Networks 172 (2020), 107183

    2020

  27. [35]

    Nickolaos Koroniotis, Nour Moustafa, Elena Sitnikova, and Benjamin Turnbull

  28. [36]

    Friedler

    Elizabeth Kumar, Suresh Venkatasubramanian, Carlos Scheidegger, and Sorelle A. Friedler. 2020. Problems with Shapley-Value-Based Explanations as Feature Importance Measures. In 37th International Conference on Machine Learning (ICML’20). PMLR, 5491–5500

    2020

  29. [37]

    Peter A Lachenbruch and Matthew Goldstein. 1979. Discriminant analysis. Bio- metrics 2, 11 (1979), 69–85

    1979

  30. [38]

    Aleksandar Lazarevic, Levent Ertoz, Vipin Kumar, Aysel Ozgur, and Jaideep Srivastava. 2003. A comparative study of anomaly detection schemes in net- work intrusion detection. In 3rd IEEE International Conference on Data Mining (ICDM’03). IEE, 25–36

    2003

  31. [39]

    Huawen Liu, Jigui Sun, Lei Liu, and Huijie Zhang. 2009. Feature selection with dynamic mutual information. Pattern Recognition 42, 7 (2009), 1330–1339

    2009

  32. [40]

    Lundberg and Su-In Lee

    Scott M. Lundberg and Su-In Lee. 2017. A Unified Approach to Interpreting Model Predictions (NeurIPS’17). In Neural Information Processing Systems (NeurIPS’17) . 17212–17223

    2017

  33. [41]

    Young-Il Moon, Balaji Rajagopalan, and Upmanu Lall. 1995. Estimation of mutual information using kernel density estimators. Physical Review E 52, 3 (1995), 2318–2321

    1995

  34. [42]

    Nour Moustafa. 2021. A new distributed architecture for evaluating AI-based security systems at the edge: Network TON_IoT datasets. Sustainable Cities and Society 72 (2021), 102994

    2021

  35. [43]

    Nour Moustafa and Jill Slay. 2015. A hybrid feature selection for network intrusion detection systems: Central points. In Australian Information Warfare Conference (AIWC’15), Vol. 16. Security Research Institute (SRI), Brisbane, 5–13. KDD ’25, August 3–7, 2025, Toronto, Canada...

    2015

  36. [44]

    Sheraz Naseer, Yasir Saleem, Shehzad Khalid, Muhammad Khawar Bashir, Jihun Han, Muhammad Munwar Iqbal, and Kijun Han. 2018. Enhanced network anom- aly detection based on deep neural networks. IEEE Access 6 (2018), 48231–48246

    2018

  37. [45]

    Jerzy Neyman and Egon Pearson. 1933. The testing of statistical hypotheses in relation to probabilities a priori. Mathematical Proceedings of the Cambridge Philosophical Society 29, 4 (1933), 492–510

    1933

  38. [46]

    Milan Paluš. 1996. Detecting nonlinearity in multivariate time series. Physics Letters A 213, 3 (1996), 138–147

    1996

  39. [47]

    Liam Paninski. 2003. Estimation of Entropy and Mutual Information. Neural Computation 15, 6 (2003), 1191–1253

    2003

  40. [48]

    Karl Pearson. 1901. LIII. On lines and planes of closest fit to systems of points in space. The London, Edinburgh, and Dublin Philosophical Magazine and Journal of Science 2, 11 (1901), 559–572

    1901

  41. [49]

    Hanchuan Peng, Fuhui Long, and Chris Ding. 2005. Feature selection based on mutual information criteria of max-dependency, max-relevance, and min- redundancy. IEEE Transactions on Pattern Analysis and Machine Intelligence 27, 8 (2005), 1226–1238

    2005

  42. [50]

    Ben Poole, Sherjil Ozair, Aaron Oord, Alexander Alemi, and George Tucker. 2019. On Variational Bounds of Mutual Information. In 37th International Conference of Machine Learning (ICML’19) . PMLR, 5171–5180

    2019

  43. [51]

    Benni Purnama, Eko Arip Winanto, Deris Stiawan, Darmawiiovo Hanapi, Mohd Yazid bin Idris, Rahmat Budiarto, et al . 2020. Features extraction on IoT intrusion detection system using principal components analysis (PCA). In 7th International Conference on Electrical Engineering, ...

    2020

  44. [52]

    Hugo Reboredo, Francesco Renna, Robert Calderbank, and Miguel RD Rodrigues

  45. [53]

    Stuart Russell and Peter Norvig. 2020. Artificial Intelligence: A Modern Approach (fourth ed.). Prentice Hall Press, USA

    2020

  46. [54]

    Thomas Schreiber. 2000. Measuring information transfer. Physical Review Letters 85, 2 (2000), 461–464

    2000

  47. [55]

    B Selvakumar and Karuppiah Muneeswaran. 2019. Firefly algorithm based feature selection for network intrusion detection. Computers & Security 81 (2019), 148– 155

    2019

  48. [56]

    Claude E Shannon. 1948. A mathematical theory of communication. The Bell System Technical Journal 27, 3 (1948), 379–423

    1948

  49. [57]

    Lloyd Shapley. 1953. A Value for n-Person Games. Contributions to the Theory of Games 2, 28 (1953), 307–318

    1953

  50. [58]

    Iman Sharafaldin, Arash Habibi Lashkari, and Ali A Ghorbani. 2018. Toward generating a new intrusion detection dataset and intrusion traffic characteriza- tion.. In 4th International Conference on Information Systems Security and Privacy (ICISSP’18). 108–116

    2018

  51. [59]

    Iman Sharafaldin, Arash Habibi Lashkari, Saqib Hakak, and Ali A Ghorbani

  52. [60]

    Nathan Shone, Tran Nguyen Ngoc, Vu Dinh Phai, and Qi Shi. 2018. A deep learning approach to network intrusion detection. IEEE Transactions on Emerging Topics in Computational Intelligence 2, 1 (2018), 41–50

    2018

  53. [61]

    Basant Subba, Santosh Biswas, and Sushanta Karmakar. 2016. A neural net- work based system for intrusion detection and attack classification. In National Conference on Communication (NCC’16) . 1–6

    2016

  54. [62]

    In 2019 International Carnahan Conference on Security Technology (ICCST’19)

    Developing realistic distributed denial of service (DDoS) attack dataset and taxonomy. In 2019 International Carnahan Conference on Security Technology (ICCST’19). IEEE, 1–8

    2019

  55. [63]

    Mukund Sundararajan and Amir Najmi. 2020. The Many Shapley Values for Model Explanation. In 37th International Conference on Machine Learning (ICML’20) . PMLR, 9269–9278

    2020

  56. [64]

    Mahbod Tavallaee, Ebrahim Bagheri, Wei Lu, and Ali A Ghorbani. 2009. A detailed analysis of the KDD CUP 99 data set. In 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications . IEEE, 1–6

    2009

  57. [65]

    Pengfei Sun, Pengju Liu, Qi Li, Chenxi Liu, Xiangling Lu, Ruochen Hao, and Jin- peng Chen. 2020. DL-IDS: Extracting features using CNN-LSTM hybrid network for intrusion detection system. Security and Communication Networks 20 (2020), 1–11

    2020

  58. [66]

    Aaron van den Oord, Yazhe Li, and Oriol Vinyals. 2019. Representation Learning with Contrastive Predictive Coding. arXiv:1807.03748 [cs.LG]

    2019 arXiv

  59. [67]

    Abhishek Verma and Virender Ranga. 2019. ELNIDS: Ensemble learning based network intrusion detection system for RPL based Internet of Things. In 4th International Conference on Internet of Things: Smart Innovation and Usages (IoT- SIU’19). IEEE

    2019

  60. [68]

    Robert Tibshirani. 1996. Regression shrinkage and selection via the Lasso.Journal of the Royal Statistical Society Series B: Statistical Methodology 58, 1 (1996), 267– 288

    1996

  61. [69]

    Patricia Wollstadt, Sebastian Schmitt, and Michael Wibral. 2023. A rigorous information-theoretic definition of redundancy and relevancy in feature selection based on (partial) information decomposition. Journal of Machine Learning Research 24, 131 (2023), 1–44

    2023

  62. [70]

    Congyuan Xu, Jizhong Shen, Xin Du, and Fan Zhang. 2018. An intrusion detection system using a deep neural network with gated recurrent units. IEEE Access 6 (2018), 48697–48707

    2018

  63. [71]

    Williams and Randall D

    Paul L. Williams and Randall D. Beer. 2010. Nonnegative Decomposition of Multivariate Information. arXiv:1004.2515 [cs.IT]

    2010 arXiv

  64. [72]

    Chuanlong Yin, Yuefei Zhu, Jinlong Fei, and Xinzheng He. 2017. A deep learning approach for intrusion detection using recurrent neural networks. IEEE Access 5 (2017), 21954–21961

    2017

  65. [73]

    2019.𝐷𝑒𝑒𝑝−𝐹𝑢𝑙𝑙−𝑅𝑎𝑛𝑔𝑒: a deep learning based network encrypted traffic classification and intrusion detection framework

    Yi Zeng, Huaxi Gu, Wenting Wei, and Yantao Guo. 2019.𝐷𝑒𝑒𝑝−𝐹𝑢𝑙𝑙−𝑅𝑎𝑛𝑔𝑒: a deep learning based network encrypted traffic classification and intrusion detection framework. IEEE Access 7 (2019), 45182–45190. Feature Selection for Network Intrusion Detection KDD ’25, August 3–7, 202...

    2019

  66. [74]

    Yutaro Yamada, Ofir Lindenbaum, Sahand Negahban, and Yuval Kluger. 2020. Feature Selection using Stochastic Gates. In 37th International Conference on Machine Learning (ICML’20). PMLR, 10648–10659

    2020

  67. [77]

    Its real-world testbed ensures the data’s reliability

    offers insights into both regular and Botnet cyberattack traffic. Its real-world testbed ensures the data’s reliability. This dataset encompasses simulations of five IoT devices, each replicating a different real-world application with 98.8% attack samples and 1.2% benign samp...

    2025

  68. [2016]

    IEEE Transactions on Signal Processing 64, 22 (2016), 5778–5793

    Bounds on the number of measurements for reliable compressive classifi- cation. IEEE Transactions on Signal Processing 64, 22 (2016), 5778–5793

    2016

  69. [2019]

    Future Generation Computer Systems 100 (2019), 779–796

    Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-IoT dataset. Future Generation Computer Systems 100 (2019), 779–796

    2019

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.