FlagThis

Abstract

**False alarms remain one of the primary barriers to the operational deployment of network intrusion detection systems (NIDS): in high-volume environments, even a sub1% false positive rate produces tens of thousands of daily alerts, overwhelming security analysts and eroding trust in automated detection. Filter-based feature selection is an attractive lever for false alarm reduction because it operates upstream of the classifier and incurs no inference-time cost. Yet classical filters apply class-symmetric criteria that ignore the operational asymmetry of intrusion detection, in which benign traffic defines the baseline and attacks are deviations from it. A recent class-asymmetric filter, Classwise Mean Deviation (CMD), addresses this asymmetry but anchors its score to a global reference mean that drifts toward attack distributions under imbalance, attenuating precisely the deviations it is meant to capture.** **We propose** _**Benign-Anchored Ranking and Selection**_ **(BARS), a two-stage filter that replaces CMDs global anchor with the benign-class mean and follows the score with an order-preserving decorrelation step. We evaluate BARS on three NIDS benchmarks spanning the imbalance spectrum (CICIDS2017, CICDDoS2019, UNSW-NB15) across five feature budgets** _k {_ 5 _,_ 10 _,_ 20 _,_ 30 _,_ 40 _}_ **. The empirical pattern matches the design rationale: on attack-majority data, where the globalanchor bias is most severe, BARS reduces FPR over CMD by 15.4% on UNSW-NB15 at** _k_ = 20 **and by 2123% on CICDDoS2019 at small budgets, while preserving true positive rate and macro-F1. On benign-majority data, BARS and CMD converge, consistent with the theoretical limit in which the global and benign-anchored scores coincide. We position BARS narrowly: it is a principled refinement of CMD specifically, not a universally dominant filter; richer methods such as Pearson correlation and Mutual Information achieve lower FPR on several settings, though they exceeded** 1 **TB of memory on the larger benchmarks in our evaluation. BARSs lineartime scoring and low memory footprint make it suited to deployments where richer methods cannot run.**