Researchers Geeta Singh and Neelu Khare of Vellore Institute of Technology in India propose an Entropy-Guided Jaya (EGJ) framework for feature selection in DDoS detection tasks. Their work, published in Frontiers in Communications and Networks, addresses a persistent weakness in wrapper-based feature selection: most metaheuristic search algorithms begin with randomly initialized candidate solutions, ignoring prior knowledge about which features actually matter. This random start can slow convergence and increase the risk of the search settling on mediocre feature subsets before it finds the informative ones.

The core innovation is a Weighted Composite Entropy (WCE) measure that fuses two complementary information-theoretic criteria. Shannon entropy quantifies the intrinsic variability and information content of a feature, while mutual information measures how much knowing that feature reduces uncertainty about the class label. Neither alone tells the full story: a feature may be highly variable yet useless for discrimination, or strongly predictive but information-poor. By combining them with tunable weights, WCE prioritizes features that are both information-rich and highly discriminative, producing a more balanced estimate of feature importance than either metric in isolation.

These entropy scores then seed the Jaya algorithm, a parameter-free population-based optimizer that iteratively moves each candidate solution toward the best solution in the population while pushing it away from the worst. Because feature selection is inherently binary, each feature is either kept or discarded, the researchers employ a binarized variant of Jaya enhanced with a Swish-based transfer function. The Swish function, smooth and non-monotonic, converts continuous solution vectors into binary feature masks through stochastic thresholding, preserving population diversity better than conventional step-function binarization.

An adaptive mutation strategy further guards against premature convergence. Mutation probability is adjusted according to the fitness gap between each candidate and the current best solution, allowing poorly performing individuals to explore the search space more aggressively while protecting high-quality subsets. Periodic random replacement every three generations injects fresh search directions, and elite solutions are retained so the best feature subsets are never lost. Checkpointing and early stopping round out the machinery, enabling recovery of long-running experiments and termination once no further improvement occurs.

To evaluate candidate feature subsets, the framework employs XGBoost, a gradient-boosted ensemble classifier implemented on the H2O distributed platform. The choice is deliberate: XGBoost offers robustness and scalability on large security datasets, and H2O’s distributed architecture reduces hardware requirements while supporting parallel model training. Fitness is assessed using macro recall across three-fold cross-validation, a metric that ensures balanced optimization across all attack categories, including minority classes often underrepresented in multiclass intrusion detection data.

The experimental benchmark is CIC-DDoS2019, a widely adopted dataset from the Canadian Institute for Cybersecurity containing realistic traffic traces across multiple reflection, amplification, and flooding attacks. After preprocessing, which removed non-informative attributes, duplicate records, invalid values, and 30 highly correlated features, the dataset retained 47 features and 259,641 balanced samples spanning eight attack types plus benign traffic. Running EGJ on this preprocessed data selected just 27 features, a substantial reduction that maintained high precision, recall, and F1-score while achieving an average accuracy of 93 percent.

Particularly notable is the framework’s performance on SSDP and UDP flood attacks, two categories that are notoriously difficult to distinguish because both rely on UDP communication and exhibit similar flow-level characteristics such as short durations, high packet rates, and bursty traffic patterns. EGJ achieved 76 percent precision and 71 percent recall for SSDP, and 75 percent precision with 77 percent recall for UDP, outperforming the baseline Multi-Island Jaya algorithm and several distributed detection frameworks. Among the selected features, attributes like DestinationPort, FlowBytes/s, PacketLengthStd, and TotalBackwardPackets capture the packet burstiness, flow asymmetry, and temporal behavior that separate amplified reflection traffic from direct flooding.

Statistical validation confirms the gains are real rather than artifacts of random variation. A one-sided exact Wilcoxon signed-rank test on paired per-class metrics yielded p-values of 0.03125 for precision and 0.015625 for recall and F1-score, all below the 0.05 significance level. The improvement of roughly 3 percent over the baseline carries substantial operational weight: when monitoring millions of network flows, even a small increase in detection accuracy translates to thousands of additional malicious flows correctly identified. Complexity analysis shows EGJ introduces only linear overhead, preserving the same asymptotic time and space requirements as conventional Jaya variants while improving convergence behavior.

Cross-dataset evaluation on UNSW-NB15, a more diverse multi-class intrusion benchmark, yielded 83.38 percent accuracy without modifying the optimization strategy, suggesting the entropy-guided approach generalizes beyond DDoS-specific traffic. The authors acknowledge that a comprehensive ablation study isolating the individual contribution of each component, Swish binarization, adaptive mutation, entropy-guided initialization, and the WCE formulation, remains future work, as does validation on additional benchmarks like CICIoT2023 and integration with online streaming learning frameworks for real-time distributed detection environments.

The broader significance lies in demonstrating that information-theoretic feature evaluation need not remain a standalone filter step but can be woven directly into wrapper-based metaheuristic search. By biasing the initial population toward informative features, EGJ starts the optimization from higher-quality candidate solutions, converges faster, and identifies compact yet discriminative feature subsets. For security teams wrestling with the scale and sophistication of contemporary DDoS attacks, from DNS and NTP amplification to SYN floods and application-layer WebDDoS, the result is a lightweight yet effective detection pipeline that reduces dimensionality, cuts computational cost, and sharpens the boundary between benign traffic and attack, even where attack categories overlap most stubbornly.

Subject of Research: Entropy-Guided Jaya optimization for robust feature selection in high-dimensional network attack detection

Article Title: Entropy-Guided Jaya optimization for robust feature selection in high-dimensional network attack detection

Article References: Singh, G., & Khare, N. (2026). Entropy-Guided Jaya optimization for robust feature selection in high-dimensional network attack detection. Frontiers in Communications and Networks, 7, Article 1886520. https://doi.org/10.3389/frcmn.2026.1886520

Image Credits: AI Generated

DOI: 10.3389/frcmn.2026.1886520

Keywords: Entropy-Guided, Jaya, optimization, robust, feature, selection, high-dimensional, network, attack, detection, scientific research