An Explainable Ensemble Feature Selection Framework for Enhanced IoT Edge Attack Detection

Abstract

—Intrusion detection systems (IDS) deployed on edge-network devices are rapidly increasing as the edge computing approach is widely applied in network infrastructure. Despite the advantages that edge computing offers, enhanced network performance in terms of latency, bandwidth consumption, and privacy, there have remained challenges related to the constrained resources of edge devices. In machine learning-based IDS systems, to deal with large, noisy, or strong feature correlations in practical IoT data, dimensionality reduction methods are often applied to generate efficient inputs for machine learning models. However, a major challenge is enhancing both the performance and explainability of the edge IDS system to meet the requirements of the security field. To overcome the challenge, we propose an explainable hybrid feature-selection framework (X-EFS) that combines multiple feature reduction techniques via a multi-expert system module, then uses the MDA metric to select the most important features, ensuring high performance and explainability. Evaluations on the CICIoT2023 dataset indicate that condensing the feature space from 46 to 6 dimensions yields an Accuracy of 98.33% and an F1-score of 98.54% across a 5-fold stratified validation. This extreme dimensionality reduction directly mitigates inference latency and memory overhead, satisfying edge-constrained deployment requirements without compromising detection capacity or intrinsic explainability.