Improving Network Anomaly Detection via Choquet-Integral-Based Feature Aggregation
It addresses feature redundancy in high-dimensional network traffic for real-time intrusion detection under bandwidth constraints.
This paper proposes a Choquet-integral-based feature aggregation method for network anomaly detection, achieving up to 7% higher accuracy and 77.5% data volume reduction without degrading precision or recall.
This work investigates a generalized Choquet-integral-based feature aggregation framework to improve anomaly detection in high-dimensional network traffic data. The approach combines adaptive weighting with incremental feature selection to address feature redundancy. Using Random Forest and XGBoost classifiers, we evaluate models trained with both raw and Choquet-aggregated features under varying feature subset sizes. The proposed aggregation achieves up to $7\%$ higher accuracy while reducing data volume by $77.5\%$ (from $214$~MB to $48$~MB), without degrading precision and recall. Results averaged over multiple stratified repetitions indicate that Choquet-based aggregation yields statistically significant gains ($p < 0.05$) in scenarios with limited feature availability, highlighting its suitability for real-time intrusion detection under bandwidth and feature-availability constraints.