nCMD: Benign-Anchored Feature Selection for Imbalanced Network Intrusion Detection

• URL: http://arxiv.org/abs/2606.09934v1
• Date: Sun, 07 Jun 2026 19:01:05 GMT
• Title: nCMD: Benign-Anchored Feature Selection for Imbalanced Network Intrusion Detection
• Abstract summary: We propose benign-anchored Classwise Mean Deviation (nCMD) to rank features in intrusion detection systems.<n>nCMD scores feature relevance based on the deviation of attack-class distributions from the benign-class mean, rather than a globally biased reference.<n>This approach aligns feature selection with the operational semantics of NIDS at no additional computational cost.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Feature selection is critical for network intrusion detection systems (NIDS) operating under high-dimensional, highly imbalanced traffic, as found in operational and defense networks. Traditional filter methods rank features using global statistics computed symmetrically across classes and thus fail to capture the asymmetry of intrusion detection, where attacks are best characterized as deviations from dominant benign traffic. We propose benign-anchored Classwise Mean Deviation (nCMD), a lightweight and interpretable method that scores feature relevance based on the deviation of attack-class distributions from the benign-class mean, rather than a globally biased reference. This approach aligns feature selection with the operational semantics of NIDS at no additional computational cost. Across four benchmark datasets (CICIDS2017, CICDDoS2019, NSL-KDD, and UNSW-NB15), multiple feature budgets, and three downstream classifiers, nCMD matches or exceeds classical filter baselines in macro-averaged F1-score. It achieves the best result on three of the four datasets and under every classifier, with the strongest improvements observed under tight feature budgets and severe class imbalance. These results support benign-anchored ranking as a scalable and interpretable preprocessing component for resource-constrained NIDS.

Related papers

• Data-Optimized Contingency Screening: A Machine Learning Approach to Power System Security [0.0]
  This study explores the use of machine learning algorithms to classify security levels of contingencies in power systems into safe, moderate or severe classes.<n>Newton-Raphson load flow method extracts system data from contingency scenarios.<n>Performance is assessed by precision, recall and F1 score, with priority given to the severe contingency classes.
  arXiv  Detail & Related papers  (2026-09-03T17:04:38Z)
• A Step Towards Robust Unsupervised Domain Adaptation via Fine-Tuning and Reinforcement Learning [2.436631469537453]
  We propose textbfSFT+RL, a two-stage robust UDA framework that integratesSupervised Fine Tuning and Reinforcement Learning.<n>textbfSFT+RL achieves average improvements of textbf10.2% in clean accuracy and textbf15.8% in adversarial robustness across three datasets.
  arXiv  Detail & Related papers  (2026-07-03T20:56:12Z)
• CANMOT: Class-Aware Noise Modeling for Multi-Object Tracking in Autonomous Driving [1.2744523252873352]
  CANMOT is a class-aware and object-aligned noise modeling framework for KF-based 3D MOT.<n>Experiments show that class-aware and object-aligned noise modeling improves tracking performance and substantially reduces identity.<n>Results reveal severe overconfidence in standard KF-based MOT baselines.
  arXiv  Detail & Related papers  (2026-06-02T12:56:31Z)
• Too Correct to Learn: Reinforcement Learning on Saturated Reasoning Data [55.84428098924793]
  We propose Constrained Uniform Top-K Sampling (CUTS), a parameter-free decoding strategy enforcing structure-preserving exploration.<n>We integrate this into Mixed-CUTS, a training framework synergizing exploitative and exploratory rollouts to amplify intra-group advantage variance.<n> Notably, Mixed-CUTS improves Pass@1 accuracy on the challenging AIME25 benchmark by up to 15.1% over standard GRPO.
  arXiv  Detail & Related papers  (2026-04-20T16:43:28Z)
• i-IF-Learn: Iterative Feature Selection and Unsupervised Learning for High-Dimensional Complex Data [5.761834753104483]
  i-IF-Learn is an unsupervised framework that jointly performs feature selection and clustering.<n>Our core innovation is an adaptive feature selection statistic that effectively combines pseudo-label supervision with unsupervised signals.<n>Experiments on gene microarray and single-cell RNA-seq datasets show that i-IF-Learn significantly surpasses classical and deep clustering baselines.
  arXiv  Detail & Related papers  (2026-03-25T07:35:38Z)
• rSDNet: Unified Robust Neural Learning against Label Noise and Adversarial Attacks [1.2891210250935143]
  We formulate neural network training as a minimum-divergence estimation problem.<n>We introduce rSDNet, a robust learning algorithm based on the general class of $S$-divergences.<n>Our results highlight minimum-divergence learning as a principled and effective framework for robust neural classification under heterogeneous data contamination.
  arXiv  Detail & Related papers  (2026-03-18T11:47:46Z)
• Hyperparameter Tuning-Based Optimized Performance Analysis of Machine Learning Algorithms for Network Intrusion Detection [0.22940141855172033]
  Network Intrusion Systems (NIDS) are essential for securing networks by identifying and mitigating unauthorized activities.<n>This study explores the application of machine learning (ML) methods to improve the NIDS accuracy.
  arXiv  Detail & Related papers  (2025-12-14T15:02:48Z)
• Unbiased Max-Min Embedding Classification for Transductive Few-Shot Learning: Clustering and Classification Are All You Need [83.10178754323955]
  Few-shot learning enables models to generalize from only a few labeled examples.<n>We propose the Unbiased Max-Min Embedding Classification (UMMEC) Method, which addresses the key challenges in few-shot learning.<n>Our method significantly improves classification performance with minimal labeled data, advancing the state-of-the-art in annotatedL.
  arXiv  Detail & Related papers  (2025-03-28T07:23:07Z)
• DiTMoS: Delving into Diverse Tiny-Model Selection on Microcontrollers [34.282971510732736]
  We introduce DiTMoS, a novel DNN training and inference framework with a selector-classifiers architecture. A composition of weak models can exhibit high diversity and the union of them can significantly boost the accuracy upper bound. We deploy DiTMoS on the Neucleo STM32F767ZI board and evaluate it based on three time-series datasets for human activity recognition, keywords spotting, and emotion recognition.
  arXiv  Detail & Related papers  (2024-03-14T02:11:38Z)
• Class-Imbalanced Semi-Supervised Learning for Large-Scale Point Cloud Semantic Segmentation via Decoupling Optimization [64.36097398869774]
  Semi-supervised learning (SSL) has been an active research topic for large-scale 3D scene understanding. The existing SSL-based methods suffer from severe training bias due to class imbalance and long-tail distributions of the point cloud data. We introduce a new decoupling optimization framework, which disentangles feature representation learning and classifier in an alternative optimization manner to shift the bias decision boundary effectively.
  arXiv  Detail & Related papers  (2024-01-13T04:16:40Z)
• Revisiting Domain-Adaptive 3D Object Detection by Reliable, Diverse and Class-balanced Pseudo-Labeling [38.07637524378327]
  Unsupervised domain adaptation (DA) with the aid of pseudo labeling techniques has emerged as a crucial approach for domain-adaptive 3D object detection. Existing DA methods suffer from a substantial drop in performance when applied to a multi-class training setting. We propose a novel ReDB framework tailored for learning to detect all classes at once.
  arXiv  Detail & Related papers  (2023-07-16T04:34:11Z)
• Divide and Contrast: Source-free Domain Adaptation via Adaptive Contrastive Learning [122.62311703151215]
  Divide and Contrast (DaC) aims to connect the good ends of both worlds while bypassing their limitations. DaC divides the target data into source-like and target-specific samples, where either group of samples is treated with tailored goals. We further align the source-like domain with the target-specific samples using a memory bank-based Maximum Mean Discrepancy (MMD) loss to reduce the distribution mismatch.
  arXiv  Detail & Related papers  (2022-11-12T09:21:49Z)
• Semi-supervised Domain Adaptive Structure Learning [72.01544419893628]
  Semi-supervised domain adaptation (SSDA) is a challenging problem requiring methods to overcome both 1) overfitting towards poorly annotated data and 2) distribution shift across domains. We introduce an adaptive structure learning method to regularize the cooperation of SSL and DA.
  arXiv  Detail & Related papers  (2021-12-12T06:11:16Z)
• Generalized Zero-Shot Learning Via Over-Complete Distribution [79.5140590952889]
  We propose to generate an Over-Complete Distribution (OCD) using Conditional Variational Autoencoder (CVAE) of both seen and unseen classes. The effectiveness of the framework is evaluated using both Zero-Shot Learning and Generalized Zero-Shot Learning protocols.
  arXiv  Detail & Related papers  (2020-04-01T19:05:28Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.