New Feature Selection Method Trims Intrusion Detection Models for Industrial Edge Devices

A machine learning framework that decides which measurements a network intrusion detector actually needs has cut the feature count on a widely used cybersecurity benchmark by roughly two thirds without losing accuracy. The method, called D-FOCUS-X, was developed by Ishfaq Hussain Rather, Upasana Dohare, Sushil Kumar, Ahmad M. Khasawneh and Omprakash Kaiwartya and published as open access research in Discover Internet of Things on 10 October 2026. Its central result: on the CICIDS2017 dataset, the framework reduced 78 original features down to 27, a 65.4 percent reduction, while Random Forest and XGBoost classifiers still reached approximately 99.9 percent accuracy on the compact set.

The motivation comes from a practical bottleneck in industrial cybersecurity. Cyber-physical systems, Industrial IoT devices and Industry 4.0 infrastructures are converging rapidly, and the attack surface of industrial environments has grown substantially as a result. Intrusion detection systems are now central to operational security, yet conventional approaches struggle in specific ways: false-positive rates remain high, distinguishing genuine cyberattacks from ordinary industrial anomalies is difficult, and the computational cost of running large models often makes deployment on resource-constrained edge devices impractical. Data scarcity compounds the problem, because labelling representative industrial attack traffic is expensive and slow.

Feature selection methods such as Recursive Feature Elimination, or RFE, are a standard answer to the dimensionality problem. They work by repeatedly removing the least useful features until only the most informative subset remains. But the authors argue that conventional RFE has a structural blind spot: it evaluates features essentially one at a time, ranking each by its marginal contribution, and so tends to miss higher-order interactions between features. In network intrusion detection, the discriminative signal for complex attack variants such as slow-rate denial-of-service often arises from the joint behaviour of temporal, volumetric and protocol features rather than from any single measurement in isolation. A feature that looks weak on its own may be crucial when combined with another.

D-FOCUS-X addresses this with what the authors call Feature-Interaction-Aware Recursive Feature Elimination. The pipeline has four stages: interaction-aware scoring, dependency preservation, recursive elimination and optimised feature set construction. In the first stage, pairwise SHAP interaction values are computed using a Random Forest estimator fitted once on the full training partition, employing TreeSHAP for exact pairwise interaction estimation. SHAP values, from SHapley Additive exPlanations, quantify how much each feature contributes to a model’s predictions; SHAP interaction values capture the additional predictive signal that arises specifically from the joint presence of two features together, beyond their individual contributions.

The second stage is where the method’s core novelty lies. The pairwise interaction values are assembled into a dependency matrix, min-max normalised, and then hierarchical clustering is applied to identify groups of mutually interacting features. Recursive elimination then operates at the cluster level rather than the individual feature level: in each iteration, the lowest-contributing cluster is removed as a whole, never splitting an interacting pair across the selection boundary. This cluster-preserving strategy ensures that no feature is eliminated in isolation when it participates in a discriminative interaction with a retained feature. The authors state that this mechanism has no direct equivalent in existing SHAP-based, RFE-based or filter-based feature selection methods applied to intrusion detection.

A further design choice removes a common manual tuning step. Rather than requiring the user to specify a target feature count in advance, D-FOCUS-X monitors the cross-validated F1-Macro score across all elimination steps and stops at the knee of the normalised performance-versus-feature-count curve, the point of maximum curvature where the marginal benefit of retaining additional features drops to near zero. This parameter-free criterion is fully reproducible given the same training data and base estimator. In the reported experiments, the knee occurred at 27 features, where the cross-validated F1-Macro score of 0.999 was statistically identical to the global peak at 78 features.

The evaluation was deliberately conducted under data-constrained conditions. A stratified 15 percent subset of CICIDS2017, approximately 91,583 records, was extracted with scikit-learn’s StratifiedShuffleSplit, preserving the original class imbalance structure to reflect the labelled-data scarcity endemic to real-world industrial deployments. The dataset, published in 2017 by the Canadian Institute of Cybersecurity at the University of New Brunswick, contains over 3.1 million records; the study framed the task as a six-class problem covering benign traffic, DoS GoldenEye, DoS Hulk, DoS Slowhttptest, DoS slowloris and Heartbleed. All 11 Heartbleed instances in the full dataset were retained unconditionally in the sample.

Pipeline integrity received explicit attention. The stratified 15 percent sample was split 80:20 into training and test sets before any preprocessing. StandardScaler normalisation, SMOTE and RandomUnderSampler resampling, and D-FOCUS-X feature selection were all fitted exclusively on the training partition and applied to the test set as fixed transformations; the test set’s 18,317 records retained the original real-world class distribution and participated in no fitting, selection or resampling operation. Resampling produced a balanced training corpus of 300,000 instances across the six classes, with synthetic Heartbleed instances generated by interpolation among the 9 real training examples. Ten-fold stratified cross-validation on the training set yielded standard deviations below 0.003 across all four evaluated classifiers, which the authors cite as evidence of stable generalisation rather than overfitting.

Performance details fill out the picture. On the 27-feature set, Random Forest achieved 99.87 percent test accuracy and XGBoost 99.82 percent, with SVM comparable and Logistic Regression noticeably lower, a pattern the authors attribute to the non-linear feature interactions in the dataset that tree-based methods capture better. An accuracy-versus-features curve at five feature counts, k of 5, 13, 27, 50 and 73, showed performance rising smoothly from 94.17 percent for Random Forest at 5 features to a plateau at 27, with no improvement from adding the remaining features. Against comparison methods at the same feature count, D-FOCUS-X reached 99.43 percent accuracy versus 99.30 percent for a SHAP-marginal baseline and 97.08 percent for conventional RFE. Applied to the full dataset, performance differed from the 15 percent subset by less than 0.50 for Random Forest and XGBoost, which the authors present as evidence of data efficiency.

The authors are candid about the limits of the efficiency claims and of the study itself. The computationally expensive selection stage took roughly 18 to 22 minutes offline on an Intel Core i5 system with 8 GB RAM and a 4 GB NVIDIA GPU, processing 300,000 resampled training instances across 10-fold cross-validation at each of 73 elimination steps; this is a one-time model-development cost, not an operational one. At deployment, the reported gains are hardware-independent estimates rather than measured latencies: memory per flow vector drops from 624 to 216 bytes with 64-bit floats, and normalisation arithmetic falls from 156 to 54 operations per sample. No direct benchmarking on physical edge hardware such as a Raspberry Pi or ARM-class board was conducted. Evaluation was also confined to a single dataset captured under controlled laboratory conditions, predominantly DoS variants, so generalisation to heterogeneous attack categories, encrypted production traffic or concept drift remains untested, with future work planned on NSL-KDD, UNSW-NB15 and CIC-IDS2018 and on direct edge-hardware deployment benchmarking.

Subject of Research: Feature-interaction-aware recursive feature elimination for intrusion detection in industrial IoT systems

Article Title: Cluster preserving recursive feature elimination framework for intrusion detection in smart industry systems

Article References: Rather, I. H., Dohare, U., Kumar, S., Khasawneh, A. M., & Kaiwartya, O. (2026). Cluster preserving recursive feature elimination framework for intrusion detection in smart industry systems. Discover Internet of Things, 6(1), Article 200. https://doi.org/10.1007/s43926-026-00505-5

Image Credits: AI Generated

DOI: 10.1007/s43926-026-00505-5

Keywords: intrusion detection, feature selection, recursive feature elimination, SHAP interaction values, Industrial IoT, machine learning, CICIDS2017, edge computing, cybersecurity, XGBoost, Random Forest, dimensionality reduction