Traffic Representation for Network Intrusion Detection

Classical intrusion-detection pipelines often reduce traffic dimensionality before classification, but feature selection and feature extraction preserve information in fundamentally different ways. We compared correlation-based feature selection with PCA-based feature extraction under controlled representation sizes, evaluating detection quality together with training and inference cost. A journal extension (Ngo et al., Cluster Computing, 2024) added systematic analysis across binary and multiclass settings and derived scenario-dependent guidance.

• · Feature selection generally performs better and faster when the retained dimensionality K is sufficiently large, whereas extraction becomes advantageous when K is very small and is less sensitive to K.
• · No single feature-reduction strategy dominates across all operating conditions — the preferred representation depends on the dimensionality budget, computational constraints, and attack-class diversity.

Fixed feature-selection rules and linear projections constrain how traffic information can be compressed, and many prior studies relied on simulated or non-UAV datasets. We introduced an autoencoder-based representation pipeline that learns a compact latent encoding of preprocessed UAV network traffic, evaluated on actual UAV intrusion traffic with benign behavior and four attack classes (DoS, Replay, Evil Twin, False Data Injection).

• · With eight extracted features, the autoencoder-based system reached 84.09% multiclass F1, compared with 80.15% and 80.89% for the two feature-selection baselines evaluated in the study.
• · The learned autoencoder representation improved multiclass detection over the feature-selection baselines evaluated on real UAV traffic.

Conventional supervised intrusion detectors remain dependent on task-specific labeled data. We reformulate tabular intrusion detection as an instruction-following problem: traffic feature names and values are serialized into a structured natural-language prompt, and a pretrained language model is adapted with LoRA to predict the attack class.

• · In the reported UAV-ID experiments, the instruction-tuned LLM reached a macro F1-score of 91.06% with 5,000 training samples, outperforming the evaluated ML/DL baselines under both matched-data and larger-data comparisons.
• · Once structured network attributes are serialized into language, intrusion detection can exploit pretrained representations rather than learning exclusively from task-specific numeric samples.