Repeated Rank-Frequency Feature Selection with Cost-Sensitive XGBoost for IoT Intrusion Detection

Abstract

Internet of Things (IoT) intrusion detection must address severe class imbalance and redundant flow descriptors while avoiding test-informed feature design. This paper presents a repeated rank-frequency feature-selection procedure combined with cost-sensitive XGBoost on RT-IoT2022. After conflict removal and deduplication, 117,911 records with 82 inputs were retained. Fifteen fold-based training perturbations were used only to generate XGBoost gain rankings; the held-out folds were not used to estimate predictive performance. The predefined Top-20/0.60 setting selected 18 features. Five nearby settings selected 13-23 features, with Jaccard similarities of 0.7222-0.8571 relative to the original subset and a maximum variation of 0.0008 across the reported core metrics. The 18-feature cost-sensitive model achieved 0.9942 Normal recall and reduced mean inference time by 37.1% versus full-feature unweighted XGBoost. Paired stratified bootstrap analysis gave a recall difference of +0.002082 [0.000000, 0.004163], while Macro-F1 decreased by 0.003311. The results support a compact error-balance trade-off rather than universal superiority.