IWSHAP-X: Enhancing Feature Selection for Intrusion Detection Systems via XAI-Guided Metaheuristics

Felipe H. Scherer; Felipe N. Dresch; Matheus M. Ciocca; Silvio E. Quincozes; Diego Kreutz; Vagner E. Quincozes

doi:10.5753/jbcs.2026.6186

Authors

Felipe H. Scherer Federal University of Pampa https://orcid.org/0009-0000-3093-7142
Felipe N. Dresch Federal University of Pampa https://orcid.org/0009-0003-9700-2909
Matheus M. Ciocca Federal University of Pampa https://orcid.org/0009-0001-5478-4985
Silvio E. Quincozes Federal University of Pampa, Federal University of Uberlândia https://orcid.org/0000-0001-6793-4033
Diego Kreutz Federal University of Pampa https://orcid.org/0000-0003-0830-0238
Vagner E. Quincozes Fluminense Federal University https://orcid.org/0000-0002-6688-5572

DOI:

https://doi.org/10.5753/jbcs.2026.6186

Keywords:

Machine Learning, Feature Selection, Metaheuristics, Premature Convergence, Explainable Artificial Intelligence (XAI)

Abstract

Feature selection plays a key role in developing effective machine learning-based Intrusion Detection Systems (IDS), as it influences model performance, computational efficiency, and explainability. While traditional methods like filter, wrapper, and embedding approaches have shown value, they frequently encounter challenges with premature convergence that can result in less optimal feature subsets. We present IWSHAP-X (IWSHAP with eXploration), an enhanced hybrid approach that combines SHapley Additive Explanations (SHAP) feature importance rankings with metaheuristic search strategies. This method extends the original IWSHAP process by introducing an additional exploration phase designed to reduce the likelihood of converging to local optima during feature selection. Our experiments with IWSHAP-X on the X-CANIDS dataset across multiple attack scenarios reveal several advantages over the original IWSHAP method. The approach demonstrates improved feature reduction capabilities while maintaining classification accuracy, along with better computational efficiency. Specifically, IWSHAP-X achieves up to 53.13% fewer selected features compared to IWSHAP, without compromising classification performance. These results suggest that IWSHAP-X offers a viable solution for IDS applications where both feature reduction and model effectiveness are important considerations.

Downloads

Download data is not yet available.

References

Abdulganiyu, O. H., Tchakoucht, T. A., and Saheed, Y. K. (2024). Towards an efficient model for network intrusion detection system (ids): systematic literature review. Wireless Networks, 30(1):453-482. DOI: 10.1007/s11276-023-03495-2.

Axelsson, S. (2000). Intrusion detection systems: A survey and taxonomy. Master's thesis, Chalmers University of Technology. Available at:[link].

Azam, Z., Islam, M. M., and Huda, M. N. (2023). Comparative analysis of intrusion detection systems and machine learning-based model analysis through decision tree. IEEE Access, 11:80348-80391. DOI: 10.1109/ACCESS.2023.3296444.

Bari, B. S., Yelamarthi, K., and Ghafoor, S. (2023). Intrusion detection in vehicle controller area network (CAN) bus using machine learning: A comparative performance study. Sensors, 23(7). DOI: 10.3390/s23073610.

Bermejo, P., Gámez, J. A., and Puerta, J. M. (2009). Incremental wrapper-based subset selection with replacement: An advantageous alternative to sequential forward selection. In 2009 IEEE symposium on computational intelligence and data mining, pages 367-374. IEEE. DOI: 10.1109/CIDM.2009.4938673.

Buiya, M. R., Laskar, A., Islam, M. R., Sawalmeh, S., Roy, M., Roy, R., and Sumsuzoha, M. (2024). Detecting iot cyberattacks: advanced machine learning models for enhanced security in network traffic. Journal of Computer Science and Technology Studies, 6(4):142-152. DOI: 10.32996/jcsts.2024.6.4.16.

Cai, J., Luo, J., Wang, S., and Yang, S. (2018). Feature selection in machine learning: A new perspective. Neurocomputing, 300:70-79. DOI: 10.1016/j.neucom.2017.11.077.

Chaitanya, K., Somayajulu, D. V., and Krishna, P. R. (2021). Memory-based approaches for eliminating premature convergence in particle swarm optimization. Applied Intelligence, 51:4575-4608. DOI: 10.1007/s10489-020-02045-z.

Chandrashekar, G. and Sahin, F. (2014). A survey on feature selection methods. Computers & electrical engineering, 40(1):16-28. DOI: 10.1016/j.compeleceng.2013.11.024.

Došilović, F. K., Brčić, M., and Hlupić, N. (2018). Explainable artificial intelligence: A survey. In 2018 41st International convention on information and communication technology, electronics and microelectronics (MIPRO), pages 0210-0215. IEEE. DOI: 10.23919/MIPRO.2018.8400040.

Dresch, F., Scherer, F., Quincozes, S., and Kreutz, D. (2024). Modelos interpretáveis com inteligência artificial explicável (xai) na detecção de intrusões em redes intra-veiculares controller area network (can). In Anais do XXIV Simpósio Brasileiro de Segurança da Informação e de Sistemas Computacionais, pages 445-460, Porto Alegre, RS, Brasil. SBC. DOI: 10.5753/sbseg.2024.241421.

Duin, R. (1998). Multiple Features. DOI: 10.24432/C5HC70.

Esseghir, M. A. (2010). Effective wrapper-filter hybridization through grasp schemata. Avaialble at:[link].

Fatema, K., Dey, S. K., Anannya, M., Khan, R. T., Rashid, M. M., Su, C., and Mazumder, R. (2025). Federated xai ids: An explainable and safeguarding privacy approach to detect intrusion combining federated learning and shap. Future Internet, 17(6):234. DOI: 10.3390/fi17060234.

Glover, Fred and Laguna, Manuel (1998). Tabu search. Springer. DOI: 10.1007/978-1-4419-7997-1_17.

Guvenir, H. and Quinlan, R. (1997). Arrhythmia. DOI: 10.24432/C5BS32.

Guyon, I. (2004). Madelon. DOI: 10.24432/C5602H.

Guyon, I. and Elisseeff, A. (2003). An introduction to variable and feature selection. Journal of machine learning research, 3(Mar):1157-1182. DOI: 10.5555/944919.944968.

Halim, Z., Yousaf, M. N., Waqas, M., Sulaiman, M., Abbas, G., Hussain, M., Ahmad, I., and Hanif, M. (2021). An effective genetic algorithm-based feature selection method for intrusion detection systems. Computers & Security, 110:102448. DOI: 10.1016/j.cose.2021.102448.

Jeong, S., Lee, S., Lee, H., and Kim, H. K. (2024a). X-CANIDS: Signal-aware explainable intrusion detection system for controller area network-based in-vehicle network. IEEE Transactions on Vehicular Technology, 73(3):3230-3246. DOI: 10.1109/TVT.2023.3327275.

Jeong, S., Lee, S., Lee, H., and Kim, H. K. (2024b). X-CANIDS: Signal-aware explainable intrusion detection system for controller area network-based in-vehicle network. IEEE Transactions on Vehicular Technology, 73(3):3230-3246. DOI: 10.1109/TVT.2023.3327275.

Khani, P., Moeinaddini, E., Abnavi, N. D., and Shahraki, A. (2024). Explainable artificial intelligence for feature selection in network traffic classification: A comparative study. Transactions on Emerging Telecommunications Technologies, 35(4):e4970. DOI: 10.1002/ett.4970.

Lamsaf, A., Carrilho, R., Neves, J. C., and Proença, H. (2025). Causality, machine learning, and feature selection: a survey. Sensors, 25(8):2373. DOI: 10.3390/s25082373.

Li, J., Cheng, K., Wang, S., Morstatter, F., Trevino, R. P., Tang, J., and Liu, H. (2017). Feature selection: A data perspective. ACM computing surveys (CSUR), 50(6):1-45. DOI: doi.org/10.1145/3136625.

Li, J., Othman, M. S., Chen, H., and Yusuf, L. M. (2024). Optimizing iot intrusion detection system: feature selection versus feature extraction in machine learning. Journal of Big Data, 11(1):36. DOI: 10.1186/s40537-024-00892-y.

Madhloom Kurdi, W. H., Alzuabidi, I. A., Najim, A. H., Kadhim, M. N., and Ahmed, A. A. (2025). Efficient two-stage intrusion detection system based on hybrid feature selection techniques and machine learning classifiers. International Journal of Intelligent Engineering & Systems, 18(3). DOI: 10.22266/ijies2025.0430.16.

Mallidi, S. K. R. and Ramisetty, R. R. (2025). Optimizing intrusion detection for iot: a systematic review of machine learning and deep learning approaches with feature selection and data balancing. Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery, 15(2):e70008. DOI: 10.1002/widm.70008.

Mitchell, R. and Chen, I.-R. (2014). A survey of intrusion detection techniques for cyber-physical systems. ACM Comput. Surv., 46(4). DOI: 10.1145/2542049.

Mohamed, N. (2025). Artificial intelligence and machine learning in cybersecurity: a deep dive into state-of-the-art techniques and future paradigms. Knowledge and Information Systems, pages 1-87. DOI: 10.1007/s10115-025-02429-y.

Nguyen, H. B., Xue, B., Liu, I., and Zhang, M. (2014). Filter based backward elimination in wrapper based pso for feature selection in classification. In 2014 IEEE Congress on Evolutionary Computation (CEC), pages 3111-3118. DOI: 10.1109/CEC.2014.6900657.

ORG, S. (2024). Welcome to the SHAP documentation. Available at:[link]. 31/01/2025.

Pasupathi, S., Kumar, R., and Pavithra, L. (2025). Proactive DDoS detection: integrating packet marking, traffic analysis, and machine learning for enhanced network security. Cluster Computing, 28(3):210. DOI: 10.1007/s10586-024-04849-x.

Pudjihartono, N., Fadason, T., Kempa-Liehr, A. W., and O'Sullivan, J. M. (2022). A review of feature selection methods for machine learning-based disease risk prediction. Frontiers in Bioinformatics, 2:927312. DOI: 10.3389/fbinf.2022.927312.

Quincozes, S. E., Mossé, D., Passos, D., Albuquerque, C., Ochi, L. S., and dos Santos, V. F. (2021). On the performance of GRASP-based feature selection for CPS intrusion detection. IEEE Transactions on Network and Service Management, 19(1):614-626. DOI: 10.1109/TNSM.2021.3088763.

Quincozes, S. E., Passos, D., Albuquerque, C., Ochi, L. S., and Mossé, D. (2020). GRASP-based feature selection for intrusion detection in cps perception layer. In 2020 4th Conference on Cloud and Internet of Things (CIoT), pages 41-48. DOI: 10.1109/CIoT50422.2020.9244207.

Quincozes, V. E., Quincozes, S. E., Kazienko, J. F., Gama, S., Cheikhrouhou, O., and Koubaa, A. (2024). A survey on IoT application layer protocols, security challenges, and the role of explainable AI in IoT (XAIoT). International Journal of Information Security, 23(3):1975-2002. DOI: 10.1007/s10207-024-00828-w.

Rana, K., Gupta, S., Kaur, G., and Yadav, A. L. (2024). Malware detection in network traffic using machine learning. In 2024 3rd International Conference on Applied Artificial Intelligence and Computing (ICAAIC), pages 358-362. IEEE. DOI: 10.1109/ICAAIC60222.2024.10575355.

Rostami, M., Berahmand, K., Nasiri, E., and Forouzandeh, S. (2021). Review of swarm intelligence-based feature selection methods. Engineering Applications of Artificial Intelligence, 100:104210. DOI: 10.1016/j.engappai.2021.104210.

Salehpour, A., Balafar, M. A., and Souri, A. (2025). An optimized intrusion detection system for resource-constrained iomt environments: enhancing security through efficient feature selection and classification. The Journal of Supercomputing, 81(6):783. DOI: 10.1007/s11227-025-07253-3.

Santhosh Kumar, S. V. N., Selvi, M., and Kannan, A. (2023). A comprehensive survey on machine learning-based intrusion detection systems for secure communication in internet of things. Computational Intelligence and Neuroscience, 2023(1):8981988. DOI: 10.1155/2023/8981988.

Santos, M. R., Guedes, A., and Sanchez-Gendriz, I. (2024). Shapley additive explanations (shap) for efficient feature selection in rolling bearing fault diagnosis. Machine Learning and Knowledge Extraction, 6(1):316-341. DOI: 10.3390/make6010016.

Scherer, F., Dresch, F., Quincozes, S., Kreutz, D., and Quincozes, V. (2024). IWSHAP: Um método de seleção incremental de características para redes can baseado em inteligência artificial explicável (XAI). In Anais do XXIV Simpósio Brasileiro de Segurança da Informação e de Sistemas Computacionais, pages 351-366, Porto Alegre, RS, Brasil. SBC. DOI: 10.5753/sbseg.2024.241780.

Singh, R. P., Dash, R., and Mohapatra, R. K. (2025). Unveiling explainability in face anti-spoofing: Hybrid feature extraction with xai-guided feature aggregation. Pattern Recognition, page 111905. DOI: 10.1016/j.patcog.2025.111905.

Song, X., Zhang, Y., Zhang, W., He, C., Hu, Y., Wang, J., and Gong, D. (2024). Evolutionary computation for feature selection in classification: A comprehensive survey of solutions, applications and challenges. Swarm and Evolutionary Computation, 90:101661. DOI: 10.1016/j.swevo.2024.101661.

Theng, D. and Bhoyar, K. K. (2024). Feature selection techniques for machine learning: a survey of more than two decades of research. Knowledge and Information Systems, 66(3):1575-1637. DOI: 10.1016/j.apenergy.2023.122079.

Tran, B., Xue, B., and Zhang, M. (2014). Improved pso for feature selection on high-dimensional datasets. In Simulated Evolution and Learning: 10th International Conference, SEAL 2014, Dunedin, New Zealand, December 15-18, 2014. Proceedings 10, pages 503-515. Springer. DOI: 10.1007/978-3-319-13563-2_43.

Van Zyl, C., Ye, X., and Naidoo, R. (2024). Harnessing explainable artificial intelligence for feature selection in time series energy forecasting: A comparative analysis of grad-cam and shap. Applied Energy, 353:122079. DOI: 10.1016/j.apenergy.2023.122079.

Vijayanand, R. and Devaraj, D. (2020). A novel feature selection method using whale optimization algorithm and genetic operators for intrusion detection system in wireless mesh network. IEEE Access, 8:56847-56854. DOI: 10.1109/ACCESS.2020.2978035.

Xie, J., Sage, M., and Zhao, Y. F. (2023). Feature selection and feature learning in machine learning applications for gas turbines: A review. Engineering Applications of Artificial Intelligence, 117:105591. DOI: 10.1016/j.engappai.2022.105591.