Modified Multi-Stage Ensemble Feature Selection (MMSE-FS) for Network Intrusion Detection

Abstract

Intrusion Detection Systems (IDS) are essential for protecting modern networks against unauthorized access and evolving cyber threats. A persistent challenge in IDS design is the high dimensionality of network traffic data, which complicates the identification of the most relevant features for effective detection. This study introduces a modified multi-stage ensemble feature selection (MMSE-FS) framework that incorporates algorithmic adaptations of Random Forest (RF), Principal Component Analysis (PCA), and KBest methods. These enhanced variants are integrated through an intelligent ensemble voting mechanism, followed by a refinement stage that further strengthens feature relevance and discriminative capability. To validate the proposed framework, experiments were conducted on the UNSW-NB15 benchmark dataset, reducing 49 initial features to 18 critical ones. The dataset was partitioned into 70% training and 30% testing subsets, and classification performance was evaluated using five machine learning classifiers (DT, RF, GB, KNN, and LR). Key hyperparameters of the proposed MMSE-FS framework (α = 0.75, λ = 1.0, and B = 50 bootstrap repetitions) were determined through 5-fold cross-validation on the training partition and subsequently fixed for all experiments. The proposed framework achieved detection accuracies ranging from 99.03% to 99.83% for binary classification and from 94.20% to 96.60% for multi-class classification. Compared with conventional feature selection methods, the proposed MMSE-FS framework substantially reduced the feature space while maintaining high detection performance across both binary and multi-class intrusion detection tasks. The reported results were obtained using the UNSW-NB15 dataset following the adopted preprocessing strategy, which excluded extremely underrepresented attack classes.