Search papers, labs, and topics across Lattice.
This paper introduces Benign-Anchored Ranking and Selection (BARS), a novel two-stage filter designed to reduce false positives in network intrusion detection systems (NIDS) by anchoring its scoring to the benign-class mean rather than a global mean. By addressing the class imbalance inherent in intrusion detection, BARS significantly outperforms the existing Classwise Mean Deviation (CMD) method, achieving a 15.4% reduction in false positive rates on the UNSW-NB15 dataset and up to 23% on the CICDDoS2019 dataset with small feature budgets. Importantly, BARS maintains a linear-time scoring process and low memory usage, making it practical for deployment in high-volume environments.
Anchoring false alarm reduction to benign traffic could revolutionize the effectiveness of intrusion detection systems in real-world applications.
False alarms remain a major barrier to deploying network intrusion detection systems (NIDS). In high-volume environments, even a sub-1% false positive rate can generate tens of thousands of daily alerts. Filter-based feature selection is attractive because it operates upstream of the classifier and adds no inference-time cost. However, classical filters use class-symmetric criteria that ignore the asymmetry of intrusion detection, where benign traffic defines the baseline and attacks are deviations from it. A recent class-asymmetric filter, Classwise Mean Deviation (CMD), addresses this issue but anchors its score to a global mean that shifts toward attack distributions under class imbalance, weakening the deviations it aims to capture. We propose Benign-Anchored Ranking and Selection (BARS), a two-stage filter that replaces CMD's global anchor with the benign-class mean and applies an order-preserving decorrelation step. We evaluate BARS on CICIDS2017, CICDDoS2019, and UNSW-NB15 using feature budgets k = {5, 10, 20, 30, 40}. On attack-majority datasets, where global-anchor bias is strongest, BARS reduces false positive rate relative to CMD by 15.4% on UNSW-NB15 at k = 20 and by 21% to 23% on CICDDoS2019 at small feature budgets while preserving true positive rate and macro-F1. On benign-majority data, BARS and CMD converge, consistent with the theoretical limit where global- and benign-anchored scores coincide. BARS is a principled refinement of CMD rather than a universally dominant filter. Although Pearson Correlation and Mutual Information often achieve lower false positive rates, they exceeded 1 TB of memory on the largest benchmarks in our evaluation. BARS retains linear-time scoring and a low memory footprint, making it suitable for resource-constrained deployments.
