FlagThis

Abstract

Feature selection is critical for network intrusion detection systems (NIDS) operating under high-dimensional, highly imbalanced traffic, as found in operational and defense networks. Traditional filter methods rank features using global statistics computed symmetrically across classes, and thus fail to capture the asymmetry of intrusion detection, where attacks are best characterized as deviations from dominant benign traffic. We propose benign-anchored Classwise Mean Deviation (nCMD), a lightweight and interpretable method that scores feature relevance by the deviation of attack-class distributions from the benign-class mean rather than a globally biased reference, aligning selection with the operational semantics of NIDS at no additional computational cost. Across four benchmark datasetsCICIDS2017, CICDDoS2019, NSL-KDD, and UNSWNB15multiple feature budgets, and three downstream classifiers, nCMD matches or exceeds classical filter baselines in macro-averaged F1-score, attaining the best result on three of the four datasets and under every classifier, with its advantage most pronounced under tight feature budgets and severe class imbalance. These results support benign-anchored ranking as a scalable, interpretable preprocessing component for resourceconstrained NIDS.