从40个特征精简至5个，还能保持高检测准确率。
Explainable Hybrid Feature Selection for Intrusion Detection in Internet of Medical Things Environments
- 先去重再结合模型与SHAP选出关键特征
- 特征减少88%后仍保持接近全量特征的精度
- 适合资源受限的医疗物联网环境部署
医疗物联网（IoMT）网络防护困难：设备异构、算力有限，且需实时分析流量。本文提出一种入侵检测系统，通过特征选择应对这些挑战。首先用皮尔逊相关性过滤冗余属性；再采用混合策略，结合模型重要性与SHAP归因，筛选出紧凑特征子集，并在此上训练随机森林与LightGBM分类器。利用SHAP和LIME解释各保留特征对决策的贡献。在CIC-IoMT 2024和CIC-IDS 2017数据集上，特征空间最多压缩88%（从40个降至仅5个），准确率与F1分数与全特征模型相比仅下降几个百分点。此类紧凑且可解释的检测器，是资源受限医疗网络的理想部署方案。
原文摘要 · Abstract (English)
Internet of Medical Things (IoMT) networks are hard to protect: devices are heterogeneous, computing resources are scarce, and traffic must be analyzed in real time. We present an intrusion detection system that addresses these constraints through feature selection. A Pearson correlation filter first removes redundant attributes; a hybrid strategy then combines model-based feature importance with SHAP attribution to pick a compact subset, on which we train Random Forest and LightGBM classifiers. SHAP and LIME explain what each retained feature contributes to the decisions. On CIC-IoMT 2024 and CIC-IDS 2017, the method cuts the feature space by up to 88% - from 40 to as few as 5 features - and accuracy and F1-score stay within a few points of models trained on all features. Compact, interpretable detectors of this kind are practical candidates for deployment on resource-limited medical networks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。