A Correlation-Based Feature Selection and Weighted XGBoost Framework for Minority IoT Attack Detection

Abstract

The rapid expansion of Internet of Things (IoT) environments has increased exposure to diverse cyberattacks, while severe class imbalance in network traffic continues to limit the effectiveness of intrusion detection systems (IDS), particularly for rare but security-critical attacks. This study proposes a Correlation-Based Feature Selection (CFS)–Weighted XGBoost framework that combines redundancy-aware feature selection with an embedded class-weighted learning classifier to improve minority-attack detection. The framework was evaluated on an attack-aware sampled subset of the CICIoT2023 dataset containing all 34 attack classes while preserving the original attack-frequency hierarchy. Using only the top 25 selected features, the proposed framework achieved 93.7% accuracy, 87.0% macro-F1, and 93.8% weighted F1, outperforming both full-featured baseline models and the recent Attack-aware Feature Aggregation Model (AFAM) while reducing the feature set by 37.5%. The proposed framework improved detection of minority web-based and reconnaissance attacks while maintaining strong performance on majority attack classes without relying on over-sampling or synthetic data generation. These findings demonstrate that integrating redundancy-aware feature selection with embedded class-weighted learning enables accurate, computationally efficient, and reliable intrusion detection for highly imbalanced IoT environments.