Network intrusion detection based on strict validation-guided hybrid feature selection and LightGBM

Abstract

Network intrusion detection often involves high-dimensional and redundant traffic features. This paper proposes a validation-guided MI-RF feature selection method with LightGBM for binary intrusion detection. Mutual information and random forest importance are combined to rank features from statistical dependency and embedded model perspectives. To avoid test-set tuning, feature weights and subset size are selected only on a validation split of the official training set, and the independent test set is used once for final reporting. On UNSW-NB15, the selected MI-RF + LightGBM model achieves an F1-score of 0.8953 and an AUC of 0.9842 using 30 features, while full-feature LightGBM achieves 0.8975 and 0.9855 using 194 features. The method reduces feature dimension by 84.5% while maintaining comparable performance, with ablation results slightly outperforming MI-only and RF-only selection.