Ablasi Kelompok Fitur Multi-View pada Random Forest untuk Deteksi Intrusi IIoT

Abstract

Internet of Things (IIoT) systems generate heterogeneous multisource telemetry data, including network traffic, host resource usage, and security logs. Intrusion detection studies commonly combine all available feature sources based on the assumption that incorporating more sources (multi-view) will always improve detection performance. This study examines this assumption using the X-IIoTID dataset through two experiments. First, feature selection based on Random Forest Gini importance was evaluated using five feature sizes (K = 10, 20, 30, 45, and 61), with cross-algorithm robustness assessed using Decision Tree, Logistic Regression, and K-Nearest Neighbors. Second, a systematic ablation study was conducted on seven combinations of three feature groups: Network (N), Host (H), and Log (L), with Timestamp excluded from the Network group to ensure consistent feature treatment. Using 299,999 samples, comprising 239,999 training and 60,000 test samples across 19 attack classes and a normal class, the results show that multiclass performance increased with the number of features, achieving an F1-macro of 0.876 at K = 10 and 0.912 at K = 61. The ablation study showed that the Full MultiView (N+H+L) achieved the best performance (F1-macro = 0.912), followed by N+H (0.905) and N+L (0.879). The Log group alone yielded low performance (0.098) but provided additional value when combined with Network features. These findings demonstrate that the effectiveness of multi-view intrusion detection depends on feature-source combinations rather than merely the number of sources, highlighting the importance of feature-group ablation in designing IIoT intrusion detection systems.