Hybrid Feature Selection with a Meta-learner for Explainable IoT Intrusion Detection

---

Résumé

The heterogeneity and resource constraints of IoT networks make intrusion detection complex. High dimensionality, significant class imbalance, and a lack of model interpretability challenge the deployment of effective IDS models. This paper proposes a hybrid feature selection framework driven by a supervised meta-learner that aggregates six complementary selectors: symmetric uncertainty, Pearson correlation, ReliefF, Boruta, RFE with XGBoost, and mRMR. We evaluate our approach on three public IoT datasets (RT-IoT2022, IoT-23, and CICIoT2023) with diverse characteristics, comparing three meta-learners (Random Forest, LightGBM, and Logistic Regression). The framework achieves significant dimensionality reduction: on RT-IoT2022, Random Forest reduces features from 89 to 24 (73.0%) while maintaining a Macro F1 of 0.9908, surpassing the full feature set (0.9899). On IoT-23, features are reduced from 25 to 7 (72.0%) with no loss in accuracy (Macro F1 0.955). On the highly imbalanced CICIoT2023 (27 classes, 4,484:1 ratio), our approach reduces features from 46 to 14 (69.6%) and achieves a Macro F1 of 0.9997 after resampling, though this result should be interpreted with caution given the aggressive resampling strategy employed. The retention threshold can be adjusted to offer a configurable trade-off between dimensionality reduction and predictive performance. SHAP analysis reveals that packet rates, inter-arrival times, and protocol flags are the most discriminative features. The framework provides a practical, interpretable, and configurable solution for IoT intrusion detection, adaptable to both resource-constrained edge devices and cloud-based analysis.

Mots-clés

hybrid feature selection, meta-learner, explainable AI, IoT intrusion detection, intrusion detection, feature selection