Paper deep dive
Multi-Level Distributional Entropy for Explainable Network Intrusion Detection
Mohamed Aly Bouke, Md Shohel Sayeed, Swee-Huay Heng, Azizol Abdullah, Mohamed Othman
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 97%
Last extracted: 7/5/2026, 2:47:41 AM
Summary
The paper proposes Multi-Level Distributional Entropy (MDE), an analytical framework for Network Intrusion Detection Systems (IDS) that derives interpretable entropy features directly from flow-level summary statistics (means, standard deviations, etc.) without requiring raw packet access. MDE operates at three levels: within-flow Gaussian differential entropy (L1), cross-directional Jensen-Shannon divergence (L2), and TCP flag-pattern Shannon entropy (L3). The framework is evaluated across four benchmarks (NSL-KDD, CICIDS-2017, CICIDS-2018, UNSW-NB15) using a leakage-free protocol. Results show that MDE-augmented models achieve high F1 scores comparable to conventional features, but more importantly, the authors use full operational metrics and SHAP (SHapley Additive exPlanations) to expose critical failure modes, such as the collapse of detection rates (DR) under temporal shifts and unseen attack families, which aggregate F1 scores often conceal.
Entities (9)
Relation Signals (5)
Multi-Level Distributional Entropy â evaluatedon â NSL-KDD
confidence 100% · Across four benchmarks (NSL-KDD, CICIDS-2017, CICIDS-2018, UNSW-NB15)
Multi-Level Distributional Entropy â includes â Gaussian differential entropy
confidence 100% · within-flow Gaussian differential entropy (L1)
Multi-Level Distributional Entropy â includes â Jensen-Shannon divergence
confidence 100% · cross-directional Jensen-Shannon divergence (JSD)
Multi-Level Distributional Entropy â includes â Shannon entropy
confidence 100% · TCP flag-pattern Shannon entropy (L3)
SHAP â explains â Multi-Level Distributional Entropy
confidence 90% · SHAP fold-stability analysis... confirms that entropy attributions are reproducible
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Machine learning network intrusion detection systems (IDS) rely on aggregate flow statistics that discard distributional structure, while established entropy measures require raw packet sequences unavailable in pre-aggregated flow datasets. We propose Multi-Level Distributional Entropy (MDE), an analytical framework that derives interpretable entropy features directly from flow-level summary statistics at three levels: within-flow Gaussian differential entropy, cross-directional Jensen-Shannon divergence (JSD), and Transmission Control Protocol (TCP) flag-pattern Shannon entropy, without raw packet access or training data. Across four benchmarks (NSL-KDD, CICIDS-2017, CICIDS-2018, UNSW-NB15) under a leakage-free fold-local pipeline, entropy-only features achieve weighted F1 of 0.708-0.989, matching conventional features without degrading performance. Full operational metric reporting then exposes failure modes that aggregate F1 conceals. On CICIDS-2018, F1=0.74 hides a detection rate (DR) of 0.48, and on held-out attack families F1 exceeds 0.998 while DR falls to zero. Under temporal shift, a pseudo-live replay of 703K flows reveals a threshold-ranking divergence in which score ranking is preserved (AUC=0.87) but fixed thresholds collapse (DR=0.082) and recalibration offers no recovery. SHapley Additive exPlanations (SHAP) fold-stability analysis (Spearman rho=0.80-0.95) confirms that entropy attributions are reproducible and domain-coherent across heterogeneous environments.
Tags
Links
- Source: https://arxiv.org/abs/2606.29797v1
- Canonical: https://arxiv.org/abs/2606.29797v1
Trouble viewing inline? Open PDF directly â
Full Text
98,583 characters extracted from source content.
Expand or collapse full text
Research ArticleBouke et al., 2026. Multi-Level Distributional Entropy for Explainable Network Intrusion Detection Mohamed Aly Bouke # 1,* , Md Shohel Sayeed # 1 , Swee-Huay Heng # 1 , Azizol Abdullah # 2 , Mohamed Othman # 2,3 1 Centre for Intelligent Cloud Computing, CoE for Advanced Cloud, Faculty of Information Science and Technology, Multimedia University, Jalan Ayer Keroh Lama, Bukit Beruang, 75450, Melaka, Malaysia 2 Department of Communication Technology and Networking, Faculty of Computer Science and Information Technology, Universiti Putra Malaysia, Serdang 43400, Malaysia 3 Laboratory of Computational Science and Mathematical Physics, Institute for Mathematical Research, Universiti Putra Malaysia, Serdang, Malaysia * alybouke@mmu.edu.my, bouke@ieee.org Research Article, June 30, 2026 Abstract Machine learning network intrusion detection systems (IDS) rely on aggregate flow statistics that discard distributional structure, while established entropy measures require raw packet sequences unavailable in pre-aggregated flow datasets. We propose Multi-Level Distributional Entropy (MDE), an analytical framework that derives interpretable entropy features directly from flow-level summary statistics at three levels: within-flow Gaussian differential entropy, cross- directional Jensen-Shannon divergence (JSD), and Transmission Control Protocol (TCP) flag-pattern Shannon entropy, without raw packet access or training data. Across four benchmarks (NSL-KDD, CICIDS-2017, CICIDS-2018, UNSW-NB15) under a leakage-free fold-local pipeline, entropy-only features achieve weighted F1 of 0.708â0.989, matching conventional features without degrading performance. Full operational metric reporting then exposes failure modes that aggregate F1 conceals. On CICIDS-2018, F1=0.74 hides a detection rate (DR) of 0.48, and on held-out attack families F1 exceeds 0.998 while DR falls to zero. Under temporal shift, a pseudo-live replay of 703K flows reveals a threshold-ranking divergence in which score ranking is preserved (AUC=0.87) but fixed thresholds collapse (DR=0.082) and recalibration offers no recovery. SHapley Additive exPlanations (SHAP) fold-stability analysis (SpearmanÏ = 0.80â0.95) confirms that entropy attributions are reproducible and domain-coherent across heterogeneous environments. Keywords: Intrusion detection systems, Entropy-based feature engineering, Explainable AI, SHAP, Network traffic analysis. 1 Introduction The proliferation of networked infrastructure across enterprise, cloud, and embedded environments has made automated intru- sion detection an operational necessity. Machine learning-based IDS have matured substantially over the past decade, with en- semble classifiers, particularly gradient-boosted trees and ran- dom forests, consistently achieving strong detection accuracy on standard benchmarks [1], [2]. Despite this progress, three gaps in current IDS practice constrain broader applicability. First, standard IDS pipelines operate on flow-level feature vec- tors: packet counts, byte volumes, connection duration, and statistical summaries extracted by tools such as CICFlowMeter. These aggregate descriptors discard the distributional and se- quential structure of traffic that is known to differ systematically between benign sessions and attacks [3]. Information-theoretic measures quantify precisely this kind of structural difference, yet their integration into supervised IDS pipelines has been limited by a practical barrier. Classical entropy computation such as approximate entropy (ApEn) [4] and sample entropy (SampEn) [5] requires ordered sequences of raw packet mea- surements that are unavailable in pre-aggregated flow datasets, the dominant format in the IDS benchmark literature [6], [7], [8]. No prior work derives entropy analytically from the summary statistics that flow records already contain. Second, interpretability remains limited. High-performing en- semble classifiers are opaque, and in operational security en- vironments analysts must audit model decisions before acting on them; in regulated contexts this opacity creates compliance obstacles [9], [10]. SHAP provides a theoretically grounded attribution framework [11], [12], but its application to entropy- enriched IDS pipelines has not been studied, leaving open whether entropy features receive domain-coherent SHAP expla- nations or produce consistent attributions across environments. Third, entropy-based detectors are typically evaluated on a sin- gle dataset, so the cross-dataset transferability of entropy signa- tures and the factors governing it remain unstudied. This paper addresses these gaps through the MDE framework. The statistics already present in flow records (means, standard Page 1 of 20 arXiv:2606.29797v1 [cs.CR] 29 Jun 2026 Research ArticleBouke et al., 2026. deviations, minima, maxima, and packet counts) implicitly char- acterize the underlying distributions of packet sizes and inter- arrival times; MDE computes entropy analytically from those statistics, eliminating the need for raw packet access while pro- ducing features grounded in information theory and directly interpretable via SHAP. MDE differs from three categories of related work. Conven- tional flow statistics (byte counts, packet rates, duration) capture aggregate magnitudes but not distributional structure, and are susceptible to the labeling artifacts documented by Engelen et al. [13]. Statistical feature engineering approaches (e.g. skew- ness, kurtosis, higher-order moments) are empirically motivated but lack a principled basis for feature selection; MDE features are grounded in information theory with analytic definitions and known ranges (Propositions 1 and 2). Representation learning methods (convolutional neural networks (CNNs), long short- term memory networks (LSTMs), autoencoders) extract features through training and produce non-interpretable representations; MDE features require no training data, apply to any flow-level schema, and are natively interpretable via SHAP. The main contributions of this paper are as follows: 1.We propose MDE, a method that constructs 7â12 inter- pretable entropy features analytically from pre-aggregated network flow statistics at three complementary levels, within-flow Gaussian differential entropy (L1), cross- directional JSD (L2), and flag-pattern Shannon entropy (L3), requiring no raw packet access or training data for feature construction. 2.We develop a leakage-free, fold-local protocol that re- ports the full operational metric suite (DR, false alarm rate (FAR), Matthews Correlation Coefficient (MCC), and precision-recall AUC (PR-AUC) alongside F1) and ap- plies it across cross-validation, temporal-split, pseudo-live replay, cross-dataset transfer, and unseen-attack-family settings, designed to surface failure modes that aggregate scores conceal. 3.We analyze SHAP attributions for MDE-augmented clas- sifiers across five cross-validation folds, quantifying the rank-stability and domain-coherence of analytical differ- ential entropy (ADE) and JSD attributions across struc- turally distinct environments. The remainder is organized as follows. Section 2 reviews re- lated work. Section 3 covers entropy and SHAP foundations. Section 4 presents the MDE framework. Section 5 describes the experimental setup. Section 6 reports the results. Sections 7 and 8 discuss and conclude. 2 Related Work 2.1 ML-Based IDS: Recent Advances ML-based IDS has evolved from early shallow classifiers through gradient-boosted ensembles to transformer, graph neu- ral network (GNN), and federated architectures [1], [14], [15]. Gradient-boosted trees and random forests remain consistently dominant on tabular flow data [14], while deep learning adds value in sequential and raw-packet settings. Transformer archi- tectures have been applied to flow-level sequences [16], and a recent comprehensive survey covering attention-based and large language model approaches [17] identifies cross-dataset gener- alization as the principal unsolved challenge. GNN-based ap- proaches model network topology explicitly and show promise for lateral-movement and Advanced Persistent Threat (APT) detection [18], though they require graph construction infrastruc- ture absent in standard flow deployments. Federated IDS [19] address cross-organizational data-sharing constraints, achieving near-centralized accuracy while preserving local privacy, which is an increasingly important practical requirement. Despite these architectural advances, the literature consistently relies on the same families of aggregate flow statistics (packet counts, byte volumes, flow duration) without principled information- theoretic enrichment [2], [20]. Tama and Rhee [21] and Faker and Dogdu [22] establish strong baselines on NSL-KDD with XGBoost and deep learning respectively, but both operate on entirely conventional feature sets. The recurring limitation is therefore one of representation rather than architecture. Effort has concentrated on the classifier, while the input feature space has remained aggregate and blind to the distributional structure of traffic. Beyond representation, the reliability of IDS evaluation is itself contested. Engelen et al. [13] audited CICIDS-2017 and found labeling artifacts making some attack categories trivially sepa- rable by a single feature (e.g.Flow Duration= 0). Ring et al. [2] surveyed 34 IDS datasets and concluded that most pub- lished accuracy figures are inflated by dataset-specific artifacts. Sarhan et al. [23] showed that cross-dataset transfer typically collapses to near-chance performance. Recent work on stan- dardized dataset evaluation frameworks [24] proposes MITRE ATT&CK-aligned metrics for assessing dataset relevance to real threat scenarios, reinforcing that single-dataset evaluations are insufficient for claiming generalization. Taken together, these findings indicate that single-dataset, within-distribution cross-validation (CV) evaluations reported through aggregate scores systematically overstate operational performance, yet such protocols remain the field norm. 2.2 Entropy-Based Feature Engineering Information-theoretic measures have a foundational history in network anomaly detection. Wagner and Plattner [25] showed that Shannon entropy of packet-size and source-address distri- butions detects worm propagation and Denial-of-Service (DoS) floods, establishing that entropy captures the structural regular- ity of benign traffic more robustly than absolute counts. Nychis et al. [26] confirmed empirically that header-field entropy is an effective anomaly indicator across multiple operational net- works. Xu et al. [27] showed that flooding attacks collapse destination-port entropy while benign traffic maintains it across all dimensions. Recent work continues to advance this direction: Kenyon [28] characterizes payload entropy profiles across flow types, confirming that entropy measurements reliably distin- guish attack and benign flows even without payload decryption; Yu et al. [29] propose RĂ©nyi-entropy-driven anomaly detec- tion with dynamic thresholding, achieving lower false-alarm rates than fixed-threshold Shannon-entropy detectors. Sequen- tial complexity measures such as ApEn [4] and SampEn [5] require ordered packet sequences that are incompatible with Page 2 of 20 Research ArticleBouke et al., 2026. pre-aggregated CICFlowMeter output [7], [23]. A gap there- fore persists between the well-documented discriminative value of entropy and the pre-aggregated flow formats that dominate practical IDS pipelines, for which no existing estimator derives entropy from the summary statistics the records already contain. 2.3 Explainability in IDS Explainability has become an operational requirement for IDS in high-stakes and regulated environments.Mahbooba et al. [30] showed that rule-based explanations raise analyst alert- validation rates from 61% to 94%. Patil et al. [31] demonstrated that SHAP attribution improves analyst trust in cloud-based IDS. A recent systematic review [32] covering explainable AI (XAI) methods applied to IDS (2020â2024) concludes that TreeSHAP is the dominant explanation approach for ensemble classifiers in industrial deployments, valued for its exact computation and consistency guarantees [12]. Bouke et al. [9], [10], [33] have applied SHAP to spam detection and IDS, confirming that tree- ensemble attributions are stable across folds and align with domain-expert intuition. These studies, however, attribute ex- clusively over conventional flow features; whether information- theoretic features receive coherent attributions, and whether those attributions remain consistent across heterogeneous envi- ronments, has not been examined. 2.4 Synthesis and Positioning The threads above converge on a single under-addressed need. Architectural innovation in ML-based IDS has outpaced inno- vation in feature representation, which remains aggregate and structure-agnostic; entropy captures the distributional structure that aggregate statistics discard, but its established estimators are incompatible with the pre-aggregated datasets that dominate the field; explainability is now an operational requirement, yet entropy-derived features have never been subjected to attribu- tion analysis; and prevailing single-dataset, aggregate-metric protocols overstate generalization. The present work is positioned precisely at this intersection. It derives entropy analytically from the summary statistics already present in flow records, removing the raw-packet barrier while preserving the distributional sensitivity that motivates entropy. Its closed-form features are natively interpretable, enabling a SHAP fold-stability analysis of entropy attributions. It is then evaluated under a leakage-free, multi-dataset protocol with full operational metrics that exposes the failure modes aggregate single-dataset scores conceal. The following sections formalize this framework (Section 4) and evaluate it (Section 6). 3 Background The MDE framework is grounded in three information-theoretic constructs and one attribution framework. This section defines each in the precise form used throughout the paper. 3.1 Entropy Foundations Definition 1 (Shannon entropy [34]). For a discrete random variableXwith probability mass functionp, the Shannon en- tropy isH(X) =â â x p(x) log p(x),wherelogdenotes the nat- ural logarithm throughout this paper (units: nats);H(X)â„ 0 with equality only when X is deterministic. Definition 2 (Gaussian differential entropy [35]). For a continu- ous random variableX âŒN (ÎŒ, Ï 2 ), the differential entropy is h(X) = 1 2 ln(2Ï e Ï 2 ), whereeâ 2.718is Eulerâs number,ÎŒis the mean, andÏ 2 is the variance.h(X)is a monotone increasing function of Ï , and is independent of ÎŒ . Definition 3 (Jensen-Shannon divergence [36]). For dis- tributionsPandQwith mixtureM = 1 2 (P + Q), the Jensen-Shannon divergence isJSD(Pâ„Q) = 1 2 KL(Pâ„M) + 1 2 KL(Qâ„M)â [0, ln 2],whereKL(Pâ„Q)is the Kullback-Leibler divergence. JSD is symmetric and bounded, making it a well- suited measure of distributional asymmetry between forward and backward traffic. 3.2 SHAP Attribution SHAP [11] assigns each featureia valueÏ i satisfying Ë f(x) = Ï 0 + â p i=1 Ï i , wherexâ R p is an input instance withpfeatures, Ë f(x)is the modelâs scalar output for that instance,Ï 0 = E[ Ë f]is the expected model output over the training set (the baseline prediction), andÏ i is the Shapley value from cooperative game theory, measuring the average marginal contribution of feature iacross all possible feature subsets. TreeSHAP [12] computes exact Shapley values for tree ensembles in polynomial time, enabling efficient attribution across large feature sets. 4 The MDE Framework MDE is defined through four sub-sections: the design rationale (Section 4.1), theoretical propositions (Section 4.2), the three analytical entropy levels (L1âL3), and the composite score and dataset adaptation steps. 4.1 Behavioral Representation MDE is a compact analytical feature construction method, not a feature selection method. Feature selection identifies which fea- tures within an existing set are most discriminative and discards the rest; the underlying feature pool is unchanged. MDE does not rank, filter, or reweight any existing flow feature. Instead, it constructs a small set of new features (entropy and divergence values) that are not present in any standard flow record and that did not exist before the transformation is applied. The inputs are the summary statistics already present in the record (means, standard deviations, packet counts, flag counts); the outputs are information-theoretic quantities grounded in a behavioral hypothesis about the structural difference between attack and benign traffic. MDE is also distinct from general-purpose feature transfor- mation approaches such as principal component analysis or kernel mappings. Those methods transform feature geome- try without grounding the transformation in a domain theory. Each MDE feature corresponds to a specific, formalized behav- ioral claim: L1 captures within-flow distributional complexity (Proposition 1); L2 captures directional asymmetry between source-to-destination and destination-to-source traffic (Propo- sition 2); L3 captures protocol-flag diversity. These are closed- form information-theoretic expressions, not learned represen- tations, and their expected behavior under attack and benign conditions is analytically derivable from the underlying distri- butional assumptions. Page 3 of 20 Research ArticleBouke et al., 2026. 4.1.1 Feature Set Size and Behavioral Coverage The feature count follows directly from the three-level hierarchy applied to whichever directional statistics are available in each dataset schema. For each available direction (forward, back- ward) and signal type (packet size, inter-arrival time), one ADE value is computed wherever the required mean and standard deviation are present. One JSD value is computed for each di- rectional pair whose marginal distributions can be parameterised from available statistics. One flag-entropy value is computed where per-flow flag counts are recorded. This yields 7 features on schemas with minimal directional statistics (NSL-KDD) and up to 12 on richer CICFlowMeter-format datasets. The count is not tuned to optimize any classification metric. It reflects the three behavioral dimensions (distributional complexity, di- rectional asymmetry, and protocol irregularity) with minimal redundancy. Adding further features within the same hierarchy would introduce correlated quantities computed from the same input statistics. 4.1.2 Analytical Properties of MDE Features The compact analytical design provides four concrete properties. First, portability: the formulas apply to any flow record con- taining means, standard deviations, and packet counts, without retraining or dataset-specific engineering, enabling consistent application across NSL-KDD, CICIDS-2017/2018, and UNSW- NB15 under a single analytical definition. Second, interpretabil- ity: each feature has a closed-form expression and a direct theoretical connection to traffic behavior, so SHAP attributions reflect genuinely domain-relevant quantities rather than opaque numerical artifacts. Third, analytical tractability: Propositions 1 and 2 provide closed-form bounds that predict when the features will and will not be discriminative, enabling a priori reasoning about expected behavior before any model is trained. Fourth, low inference overhead: computing 7â12 entropy values per flow adds negligible cost over conventional feature extraction. 4.1.3 Predictive Scope and Contribution Boundaries MDE does not claim predictive uplift over conventional flow statistics. As Tables 2 and 3 confirm, combined and conven- tional conditions achieve statistically indistinguishable within- distribution F1 on all tested datasets. The contribution is one of representation, providing compact, theoretically grounded entropy features with schema-independent construction, native SHAP interpretability, and full operational metric reporting, as evaluated in Section 6. 4.2 Theoretical Foundations LetD =( f i , y i ) N i=1 be a labeled IDS dataset where each flow f i â R d is a vector of pre-aggregated statistics andy i â0, 1 is a binary label (y i =1: attack,y i =0: benign). The MDE trans- formation is a deterministic mapÏ : R d â R k withkâȘ dthat derives k entropy-valued features directly from the statistics al- ready present inf i . The classifier operates on the full augmented spaceR d+k (combined condition) or onR k alone (entropy-only condition). The discriminative power of MDE rests on a fundamental gen- erative difference between automated attack tools and human- driven applications. Automated tools (scanners, Distributed Denial-of-Service (DDoS) agents, bots) operate under program- matic constraints. They generate packets of fixed or narrowly bounded size, fire probes at regular intervals, and produce near- unidirectional flows. Human-driven sessions (browsing, Voice over Internet Protocol (VoIP), streaming) exhibit natural vari- ability in packet sizes, irregular inter-arrival timing, and bidirec- tional data exchange. This asymmetry motivates three entropy- based discriminators: within-flow variance (L1), directional distributional asymmetry (L2), and protocol-flag diversity (L3). Proposition 1 (RegularityâEntropy Correspondence). LetX a ⌠N (ÎŒ a , Ï 2 a )andX b âŒN (ÎŒ b , Ï 2 b )model the packet-size distri- butions of an attack flowaand a benign flowbrespectively. If the attack tool imposes tighter size constraints than natural application traffic, then Ï a < Ï b , and h(X a ) = 1 2 ln(2Ï e Ï 2 a )< 1 2 ln(2Ï e Ï 2 b ) = h(X b ).(1) Proof. h(X)isstrictlyincreasinginÏ 2 since d dÏ 2 1 2 ln(2Ï e Ï 2 ) = 1 2Ï 2 > 0.ThereforeÏ a < Ï b â h(X a )< h(X b ). Remark 1. Even when the true packet-size distribution is non- Gaussian, the Gaussian differential entropy serves as a conser- vative lower bound. By the maximum-entropy principle, the Gaussian maximises entropy for a given variance. Hence any positive entropy gap between attack and benign flows under the Gaussian model implies a gap of at least equal magnitude under the true distribution. Remark 2 (Scope and limitations of the Gaussian approxima- tion). The Gaussian ADE (Eq. 2) is an approximation and not a claim that network packet-size distributions are Gaussian. Real traffic exhibits heavy tails (skewness 1.5â9.7, excess kurtosis 0.9â110 across benchmarks) and may be multimodal (e.g. mixed HTTP/HTTPS flows). In such cases ADE underestimates the true differential entropy and the approximation may fail for flows whose classification relies on distributional shape rather than variance contrast. Three settings where the Gaussian as- sumption is expected to degrade: (1) multimodal traffic mixtures within a single flow, (2) datasets where attack and benign traf- fic share similar variance but differ in higher-order moments, and (3) encrypted traffic where packet payloads are padded to fixed sizes. Non-parametric alternatives (kernel-density entropy, RĂ©nyi/Tsallis entropy, histogram-based estimators) could ad- dress these cases but require design choices (bandwidth, order α) that introduce their own model assumptions; we regard this as important future work. Proposition 2 (Unidirectionality and Maximum JSD). LetP = N (ÎŒ f , Ï 2 f ) andQ Δ =N (Δ ÎŒ f , Δ 2 Ï 2 f )forΔ â (0, 1], modeling backward traffic scaled to fractionΔof the forward flow. Then: (i) JSD(Pâ„Q 1 ) = 0 (symmetric bidirectional flow), (i) lim Δâ0 + JSD(Pâ„Q Δ ) = ln 2 â 0.693(unidirectional flow). Proof sketch. (i) is immediate sinceP = Q 1 . For (i), letM Δ = 1 2 (P+ Q Δ ). AsΔâ 0 + ,Q Δ concentrates near zero whilePâs sup- port is bounded away from zero, soM Δ (x)â 1 2 P(x) P-almost Page 4 of 20 Research ArticleBouke et al., 2026. 0.00.10.20.30.40.50.60.7 jsd_pkt_len (nats) 0 5 10 15 20 25 30 35 Density CICIDS-2017 Benign Attack ln 2 0.00.10.20.30.40.50.60.7 jsd_pkt_sz (nats) 0 2 4 6 8 10 12 14 UNSW-NB15 Benign Attack ln 2 Empirical JSD: attack flows concentrate near ln 20.693 nats Figure 1:Empirical JSD distributions for attack and benign flows (kernel density estimate, KDE). Attack flows in CICIDS-2017 (jsd_pkt_len) and UNSW-NB15 (jsd_pkt_sz) concentrate near the theoretical upper boundln 2â 0.693nats (dashed), while benign flows cluster near zero, validating Proposition 2 empirically. everywhere, givingKL(Pâ„M Δ )â KL(Pâ„ 1 2 P) = ln 2. Symmet- rically, near zeroM Δ (x)â 1 2 Q Δ (x), givingKL(Q Δ â„M Δ )â ln 2. SinceJSD = 1 2 KL(Pâ„M) + 1 2 KL(Qâ„M), the limit is 1 2 ln 2 + 1 2 ln 2 = ln 2. The analytical upper boundln 2corresponds closely to the max- imum SHAP-attributed JSD value (0.693nats) observed for DDoS and port-scan flows in Section 6, suggesting that the theoretical maximum is approached for strongly unidirectional attack flows. Fig. 1 shows that attack flows in both CICIDS-2017 and UNSW- NB15 concentrate nearln 2, while benign flows cluster near zero, as expected for unidirectional attack bursts approaching maximum directional asymmetry (Proposition 2). 4.3 Overview MDE computes entropy analytically from the statistical sum- maries already present in pre-aggregated flow records, without requiring raw packet sequences. Fig. 2 shows the end-to-end pipeline. Raw flow statistics feed three independent entropy levels (L1âL3), whose outputs are concatenated into a feature matrix that is passed to a tree-based classifier, with SHAP pro- viding post-hoc per-prediction explanations. The framework is also dataset-aware. The specific feature columns used at each level adapt to the schema of each benchmark, while the underlying analytical definitions stay uniform across all of them. 4.4 L1: Differential Entropy (ADE) For a network flow with forward packet length meanÎŒ f and standard deviationÏ f , we approximate the within-flow packet size distribution as Gaussian and compute: h ADE fwd = 1 2 ln(2Ï e Ï 2 f ).(2) The same is computed for the backward direction (h ADE bwd ) and for inter-arrival times. Where minimum and maximum packet lengths are available, a complementary uniform range entropy h range = ln(maxâ min)is also computed. High differential entropy in packet sizes indicates variable, structurally complex traffic; attack flows such as scanning or DDoS typically exhibit low variance in packet size (all probes or all flood packets are identical), producing low ADE values. 4.5 L2: Cross-Directional JSD A structural asymmetry between forward (source-to-destination) and backward (destination-to-source) traffic is a key character- istic of many attack types: DDoS floods are almost entirely unidirectional; port scans generate probes in one direction with negligible responses; legitimate sessions tend to be bidirectional and more balanced. MDE captures this via the JSD between the approximate forward and backward packet-length distributions: JSD pkt = JSD N (ÎŒ f , Ï 2 f )â„N (ÎŒ b , Ï 2 b ) .(3) Since the JSD between two Gaussians has no closed form, it is approximated by fitting a moment-matched Gaussian to the mixtureM = 1 2 (P + Q): the mixture mean and variance areÎŒ M = 1 2 (ÎŒ f + ÎŒ b ),Ï 2 M = 1 2 (Ï 2 f + Ï 2 b )+ 1 4 (ÎŒ f â ÎŒ b ) 2 , and JSD is evaluated using these parameters in the KL divergence formula from Definition 3. A directional balance entropy H dir =âr log râ(1â r) log(1â r), whererâ [0, 1]is the frac- tion of packets (or bytes) in the forward direction, provides a complementary measure of traffic symmetry independent of the Gaussian approximation. 4.6 L3: Flag-Pattern Entropy TCP control flags (FIN, SYN, RST, PSH, ACK, URG) carry protocol-level intent. Benign connections exhibit diverse flag sequences over their lifetime; attacks often manipulate a nar- row subset of flags (e.g. SYN-only for SYN floods, RST- heavy for reset injections). Given the per-flow flag countsc k forkâFIN,SYN,RST,PSH,ACK,URGand total flag count C = â k c k , the flag-pattern entropy is: H flags =â â k c k C log c k C .(4) Herec k /Cis the empirical probability of flag typekwithin the flow.H flags = 0when a single flag dominates (c k = Cfor onek); H flags = ln 6at maximum when all six flag types occur equally. Low flag entropy identifies flows dominated by a single flag type, a strong indicator of specific attack patterns such as SYN flooding or reset injection. 4.7 Composite MDE Score A composite score aggregates across levels by normalizing each entropy feature to[0, 1]using training-set statistics and averag- ing: s MDE = 1 |F| â fâF h f â min T h f max T h f â min T h f ,(5) whereFis the set of entropy features available for the given dataset schema,h f is the value of entropy featureffor the current flow, andmin T h f ,max T h f are the minimum and max- imum of featurefover the training setT. For temporal and hold-out experiments, normalization statistics are computed on the historical training corpus and applied unchanged to held-out flows. For cross-validation experiments, LightGBM and Ran- dom Forest are invariant to monotonic feature rescaling, so the normalization choice does not affect any reported metric;s MDE serves as an interpretability summary in that context. This score provides a single interpretable summary of the overall distribu- tional complexity of a flow, ranging from 0 (maximally regular) to 1 (maximally entropic relative to the training distribution). Page 5 of 20 Research ArticleBouke et al., 2026. Figure 2: MDE four-stage pipeline. Stage 1 (Input): pre-aggregated flow statistics (means, standard deviations, packet counts, flag counts). Stage 2 (Entropy feature construction): three levels computed analytically without raw packet access: L1 Gaussian differential ADE per traffic direction, L2 cross-directional Jensen-Shannon divergence, L3 Shannon entropy over TCP flag counts. Stage 3 (Feature assembly): the 7â12 MDE entropy features are concatenated with 41â78 conventional flow features to form the combined input; entropy-only and conventional ablations use each branch independently. Stage 4 (Output): binary attack/benign prediction and per-instance SHAP attribution from a LightGBM or random forest classifier. 5 Experimental Setup 5.1 Datasets Four publicly available benchmark datasets are selected to span three structural dimensions: (i) traffic generation era (1999â 2018), (i) attack taxonomy breadth (binary to 12 categories), and (i) feature schema heterogeneity (NSL-KDD connection records to CICFlowMeter packet statistics). Class imbalance ranges from near-balanced (NSL-KDD 43/57) to moderate (CICIDS-2018 72/28) and heavy (UNSW-NB15 93/7). This Page 6 of 20 Research ArticleBouke et al., 2026. AttackBenign 0.0 0.2 0.4 0.6 0.8 MDE Score NSL-KDD BenignAttack 0.3 0.4 0.5 0.6 0.7 0.8 0.9 CICIDS-2017 BenignAttack 0.3 0.4 0.5 0.6 0.7 0.8 0.9 CICIDS-2018 BenignAttack 0.4 0.5 0.6 0.7 0.8 0.9 1.0 UNSW-NB15 MDE Score Distribution: Benign vs Attack Figure 3: MDE score distributions (Benign vs. Attack) across all four benchmark datasets. The degree of class separation varies by dataset, reflecting each datasetâs attack structure. Table 1: Dataset summary. #Feat: number of numerical features after cleaning. Imbal.: benign : attack ratio (approximate). DatasetFlows #Feat Atk types Imbal. NSL-KDD22,54441443:57 CICIDS-2017 250,000781280:20 CICIDS-2018 150,00078272:28 UNSW-NB15 200,00041993:7 diversity is necessary to test whether the analytical MDE frame- work, which adapts its entropy computations to each schema, produces consistent, interpretable signals across structurally dis- tinct environments. Table 1 provides a structured summary; key properties are elaborated below. NSL-KDD [6] is selected as the canonical baseline for IDS research. NSL-KDD is a curated refinement of KDD Cup 1999 that removes duplicate records present in the original dataset, yielding 22,544 flows with 41 connection-level features cover- ing SYN flood, probing, R2L, and U2R attack categories. Its balanced class distribution (43% benign, 57% attack) and well- characterized properties make it the standard reproducibility anchor against which new approaches are benchmarked. Known artifact: the KDD feature set includes high-level connection summaries (e.g.,serror_rate,same_srv_rate) that en- code attack context implicitly, contributing to high conventional- feature separability. CICIDS-2017 [7] is selected for its multi-attack breadth and temporal structure. Generated over five days by the Canadian Institute for Cybersecurity using real traffic replayed through a controlled network, CICIDS-2017 contains 12 attack categories including DDoS, port scanning, brute-force, web attacks, infil- tration, and Heartbleed, covering the broadest attack taxonomy of the four evaluated benchmarks. The temporal day-by-day structure enables the time-based generalization experiment of Section 6.4. A 250K stratified sample is used for CV experi- ments. Known artifact: Engelen et al. [13] document labeling inconsistencies and near-constant features for certain attack classes; some categories are separable by a single CICFlowMe- ter statistic (e.g.,Flow Duration= 0), which contributes to near-saturated conventional-feature F1. CICIDS-2018 [7] is selected as a harder contemporary coun- terpart to CICIDS-2017. Generated independently in 2018 under a partially overlapping attack taxonomy, CICIDS-2018 exhibits substantially higher intra-class distributional overlap than CICIDS-2017, yielding a genuine classification challenge that stress-tests the entropy framework under conditions closer to operational complexity. A 150K stratified sample is used. BenignAttack 0 2,000 4,000 6,000 8,000 10,000 12,000 Count 9,711 12,833 NSL-KDD BenignAttack 0 50,000 100,000 150,000 182,177 44,685 CICIDS-2017 BenignAttack 0 20,000 40,000 60,000 80,000 100,000 107,831 42,168 CICIDS-2018 BenignAttack 0 50,000 100,000 150,000 185,190 14,810 UNSW-NB15 Class Distribution per Dataset Figure 4: Class distribution (Benign vs. Attack) across all four bench- mark datasets after stratified sampling. Known artifact: the dataset uses pre-encoded binary labels (class=0/1), and the original label column must be carefully excluded from features to prevent trivial leakage (Section 5.6). UNSW-NB15 [8] is selected for its modern attack categories and rich feature schema. Collected at the Cyber Range Lab of UNSW Canberra using the IXIA PerfectStorm tool, UNSW- NB15 contains 9 attack types (Fuzzers, DoS, Exploits, Generic, Reconnaissance, Shellcode, Worms, Backdoors, Analysis) against realistic background traffic. Its 41 features include network-level statistics not present in CICFlowMeter datasets: jitter, connection load, time-to-live (TTL) asymmetry, and ser- vice type, which provide richer proxies for L1 ADE and L3 entropy computation. A 200K stratified sample is used. Known artifact: moderate class imbalance (93% benign, 7% attack) is addressed via balanced class weights. Fig. 4 shows the class distributions. All datasets are partitioned using stratified sampling to maintain class proportions across training, validation, and test folds. 5.2 Dataset Adaptation Because the four benchmarks use different feature schemas, the MDE computation is adapted per dataset. For CICIDS- 2017/2018, all three levels are computed from packet length statistics, inter-arrival time (IAT) statistics, and TCP flag counts directly. For UNSW-NB15, jitter values serve as inter-arrival standard deviation proxies at L1, and TTL asymmetry replaces flag entropy at L3. For NSL-KDD, the rate-based features (ser- ror_rate, rerror_rate, same_srv_rate) are treated as a probability vector over connection outcomes, and their Shannon entropy constitutes the primary L1/L2 signal. In all cases, the directional balance entropy (L2) is universally computable from byte and packet counts. This adaptation strategy is the enabling design choice that allows MDE to operate across heterogeneous flow schemas under a consistent analytical framework. 5.3 Feature Construction and Ablation For each dataset, three feature matrices are constructed to isolate the contribution of MDE features: (i)Conventional: original numerical flow features only (no entropy). (i)Entropy-only: MDE features only (7â12 features de- pending on dataset schema). (i)Combined: concatenation of conventional and MDE features. This three-way ablation isolates the marginal contribution of entropy features and establishes whether they can serve as stan- dalone representations. Page 7 of 20 Research ArticleBouke et al., 2026. 5.4 Classifiers and Training Our experiments rely on two tree-ensemble classifiers, Light- GBM [37] and Random Forest [38]. LightGBM is configured with 300 estimators, a learning rate of 0.05, 63 leaves, and balanced class weights, while Random Forest uses 200 esti- mators, a maximum depth of 20, and balanced class weights. Both are trained under stratified 5-fold cross-validation us- ing a fold-local preprocessing pipeline. Within each fold, a SimpleImputer(strategy=median) is fitted on the training split and applied to both training and test splits, followed by aPercentileClipper(99.9th percentile) fitted and ap- plied in the same fold-local manner. This prevents any cross- fold leakage from preprocessing statistics. MDE features are computed from a separate globally-imputed copy of the data (for numerical stability of entropy formulas); since MDE fea- tures are deterministic closed-form functions of individual flow records and contain no target information, this does not in- troduce cross-fold leakage. Evaluation metrics are defined formally in Section 5.5. Class imbalance is handled via the class_weight=âbalancedâsetting in both classifiers. Infinite values, arising from division by zero in flow feature computation, are replaced by column medians; values exceed- ing the 99.9th percentile are clipped. 5.5 Evaluation Metrics LetTP,TN,FP, andFNdenote true positives, true negatives, false positives, and false negatives at the binary (attack/benign) decision boundary. We report the following metrics, selected to reflect both detection capability and operational cost in IDS deployment: Precision = TP TP+ FP (6) Recall (DR) = TP TP+ FN (7) FAR (FPR) = FP FP+ TN (8) F 1 = 2· Precision· Recall Precision+ Recall (9) MCC = TP· TNâ FP· FN p (TP+ FP)(TP+ FN)(TN+ FP)(TN+ FN) (10) Each metric serves a distinct diagnostic purpose. Precision (Eq. 6) measures alert reliability. Low precision means many false alarms that burden analyst triage. Recall/DR (Eq. 7) mea- sures attack coverage. Low recall means missed intrusions with potentially severe consequences. FAR/FPR (Eq. 8) quantifies the false-alarm operational burden directly relevant to security operations center (SOC) workload [30].F 1 (Eq. 9) balances precision and recall, making it the primary aggregate metric for imbalanced IDS datasets [1]. WeightedF 1 accounts for class- size differences across the multi-class setting. MCC (Eq. 10) is a correlation coefficient that provides a single balanced sum- mary even under extreme class imbalance [39]; it is reported for multi-class aggregation where weightedF 1 may be domi- nated by the majority class. ROC-AUC is the area under the receiver operating characteristic curve, measuring rank discrim- ination independent of a classification threshold [40]. AUC is particularly informative under distribution shift (Section 6.4), where per-threshold metrics conflate threshold selection with model quality. PR-AUC (area under the precision-recall curve) is the preferred discrimination metric under heavy class imbal- ance [41], reported in Tables 3, 4, and 6. The 5-fold CV ablation (Table 2) reports weightedF 1 , Precision, and Recall for each condition and classifier. The full 9-metric suite (F1, Precision, Recall, DR, FAR, Accuracy, MCC, AUC, PR-AUC) for the combined condition is in Table 3. Per-class attack-type breakdown is in Section 6.12. 5.6 Leakage Prevention Reproducible IDS evaluation requires deliberate protocol choices to prevent data contamination. We address four sources of leakage. First, preprocessing (median imputation, 99.9th- percentile clipping) is applied fold-locally inside aPipeline. The imputer and clipper are fitted only on each training fold and then applied to the corresponding validation fold, so no global statistics cross the fold boundary. Second, MDE features are deterministic closed-form functions of each flowâs own statis- tics (Eqs. 2â4) with no label dependence, so their computation introduces no leakage pathway. Third, all identifier columns (IP addresses, ports, timestamps, flow IDs) are removed before feature matrix construction. Fourth, the original label column is used only to derive binary targets and is then dropped, ensuring it cannot enter any feature set in encoded form. Without this correction, the encoded label would make several CICIDS-2018 attack categories trivially separable and inflate the measured scores, masking the genuine distributional overlap that makes the dataset a meaningful stress test. Campaign-level correlation remains an important caveat. Strati- fied random CV allows flows from the same attack campaign to appear in both train and test folds, inflating performance relative to real deployment. The temporal split (Section 6.4) is designed to quantify this optimism on CICIDS-2017. Host-based and session-level isolation would offer stricter guarantees and are recommended as evaluation standards for future work. 6 Results 6.1 Ablation Study Table 2 reports weighted F1, Precision, and Recall for each feature condition; Table 3 adds DR, FAR, Acc, MCC, AUC, and PR-AUC for the combined condition. On CICIDS-2018, combined F1â0.74 masks a DR of only 0.43 to 0.48 with FAR between 0.12 and 0.15, meaning fewer than half of attacks are detected; none of this is visible from the aggregate score alone. On CICIDS-2017 entropy-only, DR=0.984 comes at FAR=0.054, flagging 5.4% of benign flows. This precision- recall trade-off is absorbed without trace by the aggregate F1 score. On UNSW-NB15, multi-layer perceptron (MLP) achieves F1=0.940 but DR=0.561 (Table 6), inflated by the 92.6% benign majority. These three cases motivate the full metric disclosure used throughout. 6.2 Statistical Significance To quantify whether observed F1 differences are statistically reliable, we compute 95% confidence intervals from the 5-fold CV scores using thet-distribution (t 4,0.025 = 2.776) and ap- Page 8 of 20 Research ArticleBouke et al., 2026. Table 2: Ablation results: weightedF 1 , Precision (P), and Recall (R) for each feature condition, 5-fold stratified CV. Bold: bestF 1 per dataset.n f : feature counts (conv/ent/comb). Full 9-metric results (DR, FAR, Acc, MCC, AUC, PR-AUC) for the combined condition appear in Table 3. ConventionalEntropy-onlyCombined DatasetModeln f F1PRF1PRF1PR NSL-KDDLightGBM41/7/48 0.9873 0.9873 0.9873 0.9788 0.9788 0.9788 0.9875 0.9875 0.9875 RandomForest0.9851 0.9852 0.9851 0.9758 0.9759 0.9758 0.9857 0.9858 0.9857 CICIDS-2017 LightGBM78/12/90 0.9989 0.9989 0.9989 0.9551 0.9607 0.9536 0.9989 0.9989 0.9989 RandomForest0.9977 0.9977 0.9977 0.9463 0.9535 0.9442 0.9977 0.9977 0.9977 CICIDS-2018 LightGBM78/12/90 0.7396 0.7359 0.7461 0.7084 0.7035 0.7171 0.7405 0.7368 0.7467 RandomForest0.7442 0.7413 0.7567 0.6973 0.6947 0.7002 0.7443 0.7415 0.7571 UNSW-NB15 LightGBM41/11/52 0.9926 0.9930 0.9925 0.9887 0.9896 0.9883 0.9927 0.9930 0.9926 RandomForest0.9898 0.9907 0.9895 0.9875 0.9888 0.9871 0.9900 0.9909 0.9897 Table 3: Full operational metrics for the combined feature set (5-fold stratified CV, fold-local pipeline). DR=TP/(TP+FN); FAR=FP/(FP+TN); MCC=Matthews Correlation Coefficient. Bold: best F1 per dataset. CICIDS-2018 is the critical case: F1â0.74 conceals DRâ0.48, meaning fewer than half of all attacks are detected. DatasetModelF1PrecRecDRFARAccMCCAUC PR-AUC NSL-KDDLightGBM0.9875 0.9875 0.9875 0.9883 0.0136 0.9875 0.9745 0.99960.9997 RandomForest 0.9857 0.9858 0.9857 0.9844 0.0126 0.9857 0.9709 0.99940.9995 CICIDS-2017 LightGBM0.9989 0.9989 0.9989 0.9983 0.0010 0.9989 0.9964 0.99990.9997 RandomForest 0.9977 0.9977 0.9977 0.9953 0.0017 0.9977 0.9929 0.99980.9993 CICIDS-2018 LightGBM0.7405 0.7368 0.7467 0.4784 0.1483 0.7467 0.3470 0.73420.6107 RandomForest 0.7443 0.7415 0.7571 0.4334 0.1163 0.7571 0.3529 0.72310.5999 UNSW-NB15 LightGBM0.9927 0.9930 0.9926 0.9895 0.0072 0.9926 0.9484 0.99960.9950 RandomForest 0.9900 0.9909 0.9897 0.9971 0.0108 0.9897 0.9317 0.99950.9933 0.00.20.40.60.81.0 False Positive Rate 0.0 0.2 0.4 0.6 0.8 1.0 True Positive Rate NSL-KDD Conventional (AUC=0.9996) Entropy-only (AUC=0.9973) Combined (AUC=0.9996) 0.00.20.40.60.81.0 False Positive Rate 0.0 0.2 0.4 0.6 0.8 1.0 CICIDS-2017 Conventional (AUC=0.9999) Entropy-only (AUC=0.9936) Combined (AUC=0.9999) 0.00.20.40.60.81.0 False Positive Rate 0.0 0.2 0.4 0.6 0.8 1.0 CICIDS-2018 Conventional (AUC=0.7346) Entropy-only (AUC=0.6614) Combined (AUC=0.7342) 0.00.20.40.60.81.0 False Positive Rate 0.0 0.2 0.4 0.6 0.8 1.0 UNSW-NB15 Conventional (AUC=0.9996) Entropy-only (AUC=0.9990) Combined (AUC=0.9996) ROC Curves Four Datasets and Feature Conditions (LightGBM, 5-fold CV) Figure 5: ROC curves for all four datasets across three feature conditions (LightGBM, 5-fold CV). Solid blue: conventional; dashed amber: entropy-only; dash-dot green: combined. AUC values are means over folds. CICIDS-2018 shows the lowest AUC (â0.73), consistent with genuine feature-space ambiguity between attack categories. Combined condition matches or exceeds conventional on all datasets, confirming entropy features add discriminative ranking ability without degradation. ply Wilcoxon signed-rank tests [42] for paired comparisons. Withk = 5folds, the minimum achievable Wilcoxonp-value is 1/2 4 = 0.0625; we adopt a one-sided significance criterion of p†0.0625 for this sample size. Combining MDE entropy with conventional features produces no statistically significant F1 change on any tested dataset (pâ„ 0.625, confidence intervals overlap). 95% CIs for conven- tional and combined conditions are: NSL-KDD[0.985, 0.990] /[0.985, 0.990]; CICIDS-2017[0.999, 0.999]/[0.999, 0.999]; UNSW-NB15[0.992, 0.993]/[0.992, 0.993]. Entropy features do not degrade conventional performance. In contrast, the entropy-only condition achieves lower F1 than conventional on all three tested datasets in every fold (Wilcoxon p = 0.0625, the minimum achievable value, indicating a con- sistent directional difference). 95% CIs: NSL-KDD entropy [0.977, 0.980]vs. conventional[0.985, 0.990]; CICIDS-2017 en- tropy[0.954, 0.956]vs. conventional[0.999, 0.999]; UNSW- NB15 entropy[0.988, 0.989]vs. conventional[0.992, 0.993]. The gap is smallest on UNSW-NB15 (0.4 percentage points) and largest on CICIDS-2017 (4.4 p), consistent with the known artifact-driven separability of CICIDS-2017 by packet-volume features. 6.3 Entropy-Only Results The significance tests above establish that entropy features nei- ther improve nor degrade combined F1 relative to conventional features. The entropy-only condition, though weaker in absolute F1, is more revealing. Its per-dataset variation exposes where Page 9 of 20 Research ArticleBouke et al., 2026. NSL-KDD CICIDS-2017CICIDS-2018 UNSW-NB15 0.0 0.2 0.4 0.6 0.8 1.0 Weighted F1-score LightGBM conventional entropy_only combined NSL-KDD CICIDS-2017CICIDS-2018 UNSW-NB15 RandomForest conventional entropy_only combined Ablation Study: F1 by Feature Set and Dataset Figure 6: Ablation study: weighted F1-score per feature set and dataset. Gray: conventional features; amber: entropy-only (MDE); navy: combined. Table 4: CICIDS-2017 temporal evaluation: MonâThu training (150K, debiased), Friday test (100K). All metrics weighted except DR= TP/(TP+FN) and FAR = FP/(FP+TN). Bold: best per column. ModelAblationF1PrecRecDRFARMCCAUC PR-AUC LightGBMconventional 0.5082 0.7684 0.6226 0.0816 0.00020.2220 0.84350.7810 entropy_only 0.5364 0.6934 0.6289 0.1280 0.02180.2112 0.73240.6290 combined0.5080 0.7685 0.6225 0.0814 0.00020.2218 0.87160.8066 RandomForest conventional 0.6498 0.8017 0.7035 0.2790 0.00050.4296 0.81060.7665 entropy_only 0.4311 0.3460 0.5767 0.0001 0.0212 â0.0931 0.61330.5854 combined0.6514 0.8021 0.7045 0.2815 0.00060.4317 0.81840.7703 the MDE signal is strong and where it is limited by dataset structure. Fig. 6 visualises the full ablation comparison. UNSW-NB15 yields the strongest entropy-only performance (F1=0.9887/0.9875, DR=0.989/0.991), attributable to its rich jitter, load, and TTL diversity features that map directly to L1 ADE and L2 JSD. NSL-KDD achieves F1=0.9788/0.9758 (DR=0.977/0.974), where MDEâs connection-state entropy captures the structured probe-and-scan signatures characteris- tic of KDD-style attacks. CICIDS-2018 entropy-only F1= 0.708/0.697 with DR=0.41â0.44 reflects a genuine dataset property. Multiple attack categories share nearly identical flow- level distributional profiles, differing primarily in absolute mag- nitude rather than structural shape. Entropy features respond to distributional structure, not magnitude, so they cannot resolve categories whose discriminative signal lies elsewhere. The com- bined condition improves only marginally (F1=0.740/0.744), and neither feature family alone nor their combination over- comes this intra-class ambiguity. It is a dataset property, not a modeling failure. 6.4 Temporal Generalization To evaluate temporal generalization, we train on Mondayâ Thursday files (150K stratified sample, 12 attack types) and test on the Friday files (100K stratified sample), which con- tain DDoS and PortScan, attack types that were only partially represented in the training period. Table 4 reports the results. Table 4 shows that all models fail to detect the majority of at- tacks under distribution shift, and F1 substantially overstates operational utility. LightGBMâs DR collapses to 0.082 under shift despite weighted F1â0.51, because the model defaults to predicting benign. It detects fewer than 1 in 12 attacks. The best result comes from Random Forest (RF) combined (DR=0.2815, MCC=0.4317, FAR=0.0006), which still misses more than 70% of attacks while keeping false alarms near zero. RF entropy-only is the clearest failure: DRâ0.000, MCC=â0.093(below-random correlation), and FAR=0.021, a situation where the model generates false alarms on benign traffic while detecting almost no attacks, a catastrophic inversion that would be invisible if only F1=0.43 were reported. The one encouraging finding is that entropy features preserve discrimina- tion at the score level. Combined LightGBM achieves AUC= 0.8716 and PR-AUC=0.8066 versus 0.8435/0.7810 for conven- tional, confirming that entropy scores retain relative ordering ability under shift even when fixed classification thresholds break down. This divergence between threshold performance (DR, MCC) and ranking performance (AUC) indicates that en- tropy score ordering is partially preserved under shift even when fixed classification thresholds fail. 6.5 Pseudo-Live Temporal Replay The batch temporal evaluation (Section 6.4) characterizes aggre- gate performance after training. To assess operational behavior under a realistic inference scenario, we implement a pseudo- live temporal replay. The complete pipeline (imputer, clipper, LightGBM) is trained once on MondayâThursday traffic (150K flows), all parameters are frozen, and the full Friday traffic (703K flows) is then replayed chronologically without labels, re- training, or threshold adaptation. Friday flows are sorted by their original timestamps and divided intoN = 20equal windows; metrics are computed retrospectively in each window using ground-truth labels only after replay completes. We compare two threshold strategies: fixed (Ξ = 0.5) and Youdenâs-J optimal threshold derived from training-set predicted probabilities. Table 5 summarizes overall results across feature conditions. DR collapses to 0.08â0.13 across all conditions, consistent with the batch evaluation, while AUC remains 0.73â0.87. Critically, threshold recalibration provides no improvement. The Youden threshold (0.716 for combined) is derived from a training dis- tribution where attacks receive high probabilities, but under temporal shift the score distribution drifts downward, placing attack flows below any reasonable decision boundary regardless of threshold choice. DR withΞ Youden is within0.001of fixed Ξ = 0.5 in every condition. Table 5: Pseudo-live temporal replay summary: LightGBM, full Friday traffic (703K flows, 20 windows). DR and FAR under fixedΞ = 0.5and Youdenâs-J threshold. AUC is threshold-independent. Feature setΞ Youden DR Ξ=0.5 DR Ξ Y FAR Ξ=0.5 MCCAUC Conventional0.7160.081 0.0810.000 0.221 0.842 Entropy-only0.5040.125 0.1250.022 0.208 0.732 Combined0.7140.081 0.0810.000 0.221 0.871 The window-by-window breakdown (Figure 7) reveals a pattern invisible in aggregate results. Windows 3â8 correspond to a DDoS surge period in which 50â99% of flows are attacks. In these windows, DR falls to zero across all conditions while AUC remains 0.70â0.95: the classifier correctly ranks attacks above benign flows in relative terms, but the absolute predicted scores shift below the decision boundary, causing complete operational failure. Windows 9â14, dominated by PortScan traffic with a more heterogeneous attack signature, show partial recovery (DR 0.09â0.36, AUC 0.82â0.99). This two-phase structure il- lustrates that the AUC-DR divergence identified in Section 6.4 is not a global averaging artifact but a flow-period-specific col- lapse. During high-volume homogeneous attack bursts, score calibration degrades while discrimination is preserved. Page 10 of 20 Research ArticleBouke et al., 2026. 0.00 0.05 0.10 0.15 0.20 0.25 0.30 0.35 Detection Rate (DR) Solid=fixed thr Dashed=Youden thr Conventional Entropy Only Combined 0.00 0.02 0.04 0.06 0.08 0.10 0.12 0.14 0.16 False Alarm Rate (FAR) 0.4 0.2 0.0 0.2 0.4 MCC 2.55.07.510.012.515.017.520.0 Replay Window (chronological order) 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 ROC-AUC Pseudo-Live Temporal Replay CICIDS-2017 MonThu Friday Operational Metrics over 20 Chronological Windows (Fixed vs Youden Threshold) Figure 7: Pseudo-live temporal replay: operational metrics over 20 chronological Friday windows (CICIDS-2017). Solid lines: fixed threshold (Ξ = 0.5); dashed lines: Youdenâs-J threshold. Windows 3â8 correspond to the DDoS surge period; windows 9â14 to PortScan. DR collapses to zero during the surge while AUC reaches 0.95, demonstrating that score calibration fails before discrimination does. 6.6 Baseline Comparison Table 6 situates within-distribution performance of MDE against a broad set of classifiers. A fair comparison requires identical train/test splits, identical preprocessing, and identical metrics. Table 6 reports 5-fold CV results for seven classifiers on the com- bined MDE feature set across all four datasets: three gradient- boosted tree methods (LightGBM, Random Forest, XGBoost), CatBoost [43], and three neural approaches (MLP, TabNet [44], FT-Transformer [45]). MLP, TabNet, and FT-Transformer use a stratified 30K-sample subset for computational feasibility; tree- Page 11 of 20 Research ArticleBouke et al., 2026. based classifiers run on full data. All models use the identical leakage-free pipeline (fold-local imputation and percentile clip- ping). Reporting the full suite of operational metrics, including DR, FAR, MCC, and F1, exposes critical gaps that aggregate scores alone would conceal. On UNSW-NB15, MLP achieves F1=0.9417 but DR=0.5809, inflated by the heavily benign majority; TabNet (DR=0.9747) and FT-Transformer (DR= 0.9997) recover substantially through their attention mecha- nisms on this dataset. Gradient-boosted classifiers (LightGBM, XGBoost, CatBoost) consistently achieve DRâ„0.96 on NSL- KDD, CICIDS-2017, and UNSW-NB15, with MCCâ„0.93 on those three datasets. CICIDS-2018 is the critical stress test. Its genuine intra-class ambiguity exposes the limits of every approach. No classifier achieves DR above 0.48, MCC falls below 0.43 for all models, and deep learning methods (MLP DR=0.1688, TabNet DR=0.2178) underperforming tree- based methods on detection rate under this harder distribution. XGBoost achieves the highest F1 on CICIDS-2018 (0.7467), NSL-KDD (0.9878, tied with CatBoost), and UNSW-NB15 (0.9935), while LightGBM leads on CICIDS-2017 (0.9989). FT-Transformer [45] and TabNet [44] are competitive on well- balanced datasets but require substantially more computation for modest F1 gains over gradient-boosted trees on tabular network flow data. The consistent dominance of gradient-boosted trees (GBTs) observed here reflects structural properties of pre-aggregated flow records [46]. Network flow features are heterogeneous in scale and heavily skewed; GBTs handle this natively through recursive splitting that is invariant to monotone transformations, requiring no normalization beyond the fold-local percentile clip- ping applied here. High-order feature interactions (e.g. joint packet-size and direction signals) are captured greedily with- out manual feature construction. Deep architectures benefit most when inputs exhibit local correlations, spatial regularity, or smooth temporal structure, and none of these properties hold for flow-level statistical summaries. Attention-based models (FT- Transformer, TabNet) address some of these limitations through learned per-feature embeddings and attention over feature to- kens, narrowing the gap on balanced, well-structured datasets (NSL-KDD, UNSW-NB15 in Table 6), but have not consistently surpassed GBTs on datasets with fewer than10 6 samples and strong class imbalance [46]. The CICIDS-2018 results are il- lustrative. No deep model improves on F1 or DR relative to the best tree-based classifier, and MLP degrades substantially (DR=0.169 vs. 0.478 for LightGBM). Table 7 situates MDE-IDS against published methods. Because those studies use different datasets, preprocessing pipelines, and evaluation protocols, the comparison is indicative only; the in- pipeline Table 6 is the scientifically fair reference. MDE-IDS provides SHAP-based explainability, which is not reported by any baseline method. 6.7 SHAP Waterfall Analysis The attribution structure of MDE features (which entropy fea- tures drive predictions and whether attributions are consistent across datasets) is examined below. We first verify leakage-free attribution, then assess cross-dataset rank stability, and finally examine instance-level waterfall plots. All SHAP figures were generated from the leakage-free pipeline (label column removed from feature matrices before SHAP computation). Feature name audits confirmed that no label- related column appears in any SHAP plot. Each dataset passed a programmatic check verifying that no feature name contains the strings label, class, attack, binary, or multi. Formal cross-dataset Spearman correlation is not feasible be- cause each datasetâs conventional features carry schema-specific column names (e.g.,Total_Length_of_Fwd_Packets in CICIDS vs.src_bytesin NSL-KDD), leaving fewer than three features in common by name across any pair. We therefore assess stability via the MDE top-10 fraction: the proportion of the top-10 SHAP features (by mean absolute SHAP value on the full training set) that are MDE-type (L1 ADE, L2 JSD, or L3 flag entropy). Across four datasets: DatasetMDE in top-10Fraction CICIDS-20174/1040% UNSW-NB155/1050% NSL-KDD3/1030% CICIDS-20183/1030% The MDE fraction ranges 30â50% across all four environments, despite heterogeneous feature schemas and attack taxonomies. Given that MDE contributes only 7â12 features out of 41â90 total (8â29% by count), a consistent 30â50% share of top-10 attributions indicates that entropy features are disproportionately represented in SHAP importance rankings across structurally distinct environments. Fig. 9 shows the SHAP waterfall plot for the most confidently classified attack instance in CICIDS-2017 (LightGBM, com- bined features). A waterfall plot decomposes the model output for a single instance. Starting from the expected model output E[ f(X)](base value), each bar shows how a specific featureâs value pushes the prediction upward (toward attack) or downward (toward benign), arriving at the final model outputf(x). The cross-directional JSD (jsd_pkt_len = 0.693, the maximum possible, indicating fully unidirectional traffic) contributes the largest positive SHAP value, identifying a near-zero backward traffic volume, a signature consistent with DDoS or port-scan ac- tivity. The directional balance entropy (dir_entropy_pkts â 0 ) and flag entropy (flag_entropy) both push the predic- tion toward attack, while conventional features such asFlow Durationand packet length statistics provide complementary marginal contributions. Fig. 10 shows the corresponding waterfall for UNSW-NB15. Theade_src_iatfeature (Gaussian differential entropy of source inter-arrival times) dominates. A low value indicates highly regular, periodic packet timing typical of automated at- tack tools such as scanners and bots, whereas human-driven ses- sions exhibit higher IAT variability. Thejsd_pkt_szfeature (cross-directional size JSD) further confirms that the flagged flow has structurally different source and destination packet distributions, consistent with a probe-response asymmetry. 6.8 Cross-Dataset Entropy Analysis The waterfall plots above show attribution patterns for individ- ual instances. To characterize the direction and magnitude of the entropy signal at the dataset level, Fig. 11 presents the entropy Page 12 of 20 Research ArticleBouke et al., 2026. Table 6: Classifier comparison: seven models on the combined MDE feature set, identical 5-fold stratified CV, leakage-free fold-local pipeline. MLP, TabNet, FT-Transformer use 30K stratified subsample (â ). DR=TP/(TP+FN); FAR=FP/(FP+TN). Bold: best F1 per dataset. Gradient- boosted trees run on full dataset; deep models on 30K subsample for computational feasibility. DatasetClassifierF1PrecRecDRFARAccMCC PR-AUC NSL-KDDLightGBM0.9875 0.9875 0.9875 0.9883 0.0136 0.9875 0.97450.9997 Random Forest0.9857 0.9858 0.9857 0.9844 0.0126 0.9857 0.97090.9995 XGBoost0.9878 0.9878 0.9878 0.9890 0.0138 0.9878 0.97510.9997 CatBoost0.9878 0.9878 0.9878 0.9873 0.0116 0.9878 0.97510.9996 MLP â 0.9697 0.9698 0.9697 0.9766 0.0393 0.9697 0.93840.9813 TabNet â 0.9705 0.9705 0.9705 0.9750 0.0355 0.9705 0.93980.9967 FT-Transformer â 0.9818 0.9818 0.9818 0.9836 0.0206 0.9818 0.96290.9989 CICIDS-2017 LightGBM0.9989 0.9989 0.9989 0.9983 0.0010 0.9989 0.99640.9997 Random Forest0.9977 0.9977 0.9977 0.9953 0.0017 0.9977 0.99290.9993 XGBoost0.9987 0.9987 0.9987 0.9975 0.0011 0.9987 0.99580.9997 CatBoost0.9982 0.9983 0.9982 0.9986 0.0018 0.9982 0.99450.9994 MLP â 0.9369 0.9382 0.9362 0.8710 0.0478 0.9362 0.80400.7816 TabNet â 0.9687 0.9693 0.9692 0.8861 0.0104 0.9692 0.90120.9711 FT-Transformer â 0.9728 0.9746 0.9723 0.9832 0.0304 0.9723 0.91770.9899 CICIDS-2018 LightGBM0.7405 0.7368 0.7467 0.4784 0.1483 0.7467 0.34700.6107 Random Forest0.7443 0.7415 0.7571 0.4334 0.1163 0.7571 0.35290.5999 XGBoost0.7467 0.8064 0.7881 0.2867 0.0159 0.7881 0.42120.6092 CatBoost0.7429 0.7397 0.7551 0.4355 0.1199 0.7551 0.34920.6000 MLP â 0.6795 0.7121 0.7401 0.1688 0.0364 0.7401 0.22030.4309 TabNet â 0.7134 0.7825 0.7668 0.2178 0.0184 0.7668 0.34350.5111 FT-Transformer â 0.7190 0.7241 0.7392 0.3624 0.1135 0.7392 0.29750.5067 UNSW-NB15 LightGBM0.9927 0.9930 0.9926 0.9895 0.0072 0.9926 0.94840.9950 Random Forest0.9900 0.9909 0.9897 0.9971 0.0108 0.9897 0.93170.9933 XGBoost0.9935 0.9936 0.9935 0.9626 0.0040 0.9935 0.95310.9942 CatBoost0.9897 0.9906 0.9893 0.9984 0.0114 0.9893 0.92930.9933 MLP â 0.9417 0.9410 0.9426 0.5809 0.0285 0.9426 0.56930.3940 TabNet â 0.9867 0.9877 0.9863 0.9747 0.0128 0.9863 0.90820.9393 FT-Transformer â 0.9881 0.9894 0.9876 0.9997 0.0133 0.9876 0.91940.9858 delta heatmap. It is the difference in mean MDE score between attack and benign traffic per dataset. Positive delta (attack> benign) indicates that attack flows exhibit higher overall dis- tributional entropy; negative delta indicates the reverse. The sign of the delta differs across datasets, reflecting fundamen- tally different attack structures. Modern multi-vector attacks (UNSW-NB15) and volumetric attacks (CICIDS-2017) produce flows with higher entropy than benign traffic, while classical probe and scan attacks in NSL-KDD tend toward lower entropy (structured, repetitive patterns). 6.9 Cross-Dataset Transfer To evaluate whether MDE entropy signatures generalize be- yond their training distribution, we conduct a zero-shot cross- dataset transfer experiment using the two CIC-FlowMeter- format datasets (CICIDS-2017 and CICIDS-2018), which share an identical entropy feature schema (12 common MDE features). A LightGBM model trained on one datasetâs entropy-only fea- tures is applied directly to the other dataset, without retraining or fine-tuning. Table 8 presents results alongside in-distribution hold-out baselines. The results reveal an expected but informative transfer gap. CICIDS-2017 trains a model attuned to the entropy signa- tures of DDoS, port-scan, and brute-force attacks, which dif- fer structurally from the web-layer and brute-force profile of CICIDS-2018; the zero-shot F1 drops from 0.955 to 0.591. In the reverse direction, the CICIDS-2018 model, which was itself trained on a harder entropy classification problem (in- distribution F1=0.718), achieves F1=0.743 on CICIDS-2017, partially because its attacks produce entropy patterns that over- lap with a subset of CICIDS-2017 categories. The AUC=0.31 in the CICIDS-2018â2017 direction indicates near-random class ordering for certain attack sub-types, indicating that entropy Page 13 of 20 Research ArticleBouke et al., 2026. Benign Attack Predicted Benign Attack True 0.986 (9,579) 0.014 (132) 0.012 (150) 0.988 (12,683) NSL-KDD Benign Attack Predicted Benign Attack 0.999 (181,995) 0.001 (182) 0.002 (75) 0.998 (44,610) CICIDS-2017 Benign Attack Predicted Benign Attack 0.852 (91,835) 0.148 (15,996) 0.522 (21,994) 0.478 (20,174) CICIDS-2018 Benign Attack Predicted Benign Attack 0.993 (183,855) 0.007 (1,335) 0.010 (155) 0.990 (14,655) UNSW-NB15 0.0 0.2 0.4 0.6 0.8 1.0 0.0 0.2 0.4 0.6 0.8 1.0 0.0 0.2 0.4 0.6 0.8 1.0 0.0 0.2 0.4 0.6 0.8 1.0 Confusion Matrices Four Datasets, Combined Features, LightGBM (5-fold CV, Normalised by Row) Figure 8: Normalized confusion matrices (rows=true label, columns=predicted label) for four datasets using LightGBM with combined features (5-fold CV, pooled predictions). Cell values show row-normalized proportion and raw count. Diagonal dominance confirms high accuracy on NSL-KDD, CICIDS-2017, and UNSW-NB15. CICIDS-2018 shows the most off-diagonal mass, with approximately 52% of attacks (class 1) misclassified as benign, which aligns with the DRâ 0.48 reported in Table 2. Table 7: Cross-literature context (indicative only; different protocols). MDE-IDS (LGB) = LightGBM combined; Met. = reported metric. DatasetMethodMet.Score NSL-KDDXGBoost [21]F10.9884 NSL-KDDDeep N [22]Acc0.9910 NSL-KDDMDE-IDS (LGB)F10.9875 CIC-2017CNN-LSTM [47]F10.9780 CIC-2017RF [13]Acc0.9997 CIC-2017MDE-IDS (LGB)F10.9989 UNSW-NB15 Wrap-N [48]Acc0.9750 UNSW-NB15 Transformer [16]F10.9812 UNSW-NB15 MDE-IDS (LGB)F10.9927 Table 8: Zero-shot cross-dataset transfer (entropy-only features, Light- GBM). Hold-out : 80/20 in-distribution split; Transfer : model applied to a different dataset without retraining. SourceTargetF1 AUC CIC-2017 CIC-2017 (hold-out) 0.955 0.994 CIC-2017 CIC-2018 (transfer)0.591 0.538 CIC-2018 CIC-2018 (hold-out) 0.718 0.669 CIC-2018 CIC-2017 (transfer)0.743 0.309 signatures are attack-family-specific within the tested environ- ments. These results confirm that entropy-based features, like all discriminative representations, require domain adaptation when the attack taxonomy changes. 6.10 Noise Robustness We evaluate the resilience of MDE entropy features to mea- surement uncertainty by adding zero-mean Gaussian noise N (0, Δ 2 Ë Ï 2 j ) to each featurejat inference time, where Ë Ï j is the per-feature standard deviation of the training set and Δ â0.05, 0.10, 0.25is the noise fraction. Models are trained on clean data; noise is injected only at test time to simulate sensor degradation or measurement error. UNSW-NB15 shows the strongest robustness: F1 degrades by onlyâ = 0.049atΔ = 0.25, reflecting that the IAT reg- ularity and directional asymmetry signals in this dataset are large-magnitude relative to noise. NSL-KDD and CICIDS-2017 exhibit moderate degradation (â = 0.160andâ = 0.207respec- tively), with no catastrophic failure. The entropy features retain 105051015 76 other features 0.69 = mde_score 1908.911 = Packet Length Std 153.871 = Fwd Packet Length Std 0 = Bwd Packet Length Min 3643942.5 = Packet Length Variance 101000000 = Idle Max 101000000 = Fwd IAT Total 101000000 = Fwd IAT Max 1656.429 = Bwd Packet Length Mean 1 = FIN Flag Count 0 = Init_Win_bytes_forward 235 = Init_Win_bytes_backward 0 = flag_entropy 2429.119 = Bwd Packet Length Std 76 other features mde_score Packet Length Std Fwd Packet Length Std Bwd Packet Length Min Packet Length Variance Idle Max Fwd IAT Total Fwd IAT Max Bwd Packet Length Mean FIN Flag Count Init_Win_bytes_forward Init_Win_bytes_backward flag_entropy Bwd Packet Length Std +7.69 +3.25 +3.14 +2.15 +1.49 +1.13 +0.52 +0.46 +0.45 +0.43 +0.4 +0.32 +1.62 0.36 0.27 E[f(X)] =7.905 f(x) = 14.494 SHAP Waterfall (Attack) CICIDS-2017 Figure 9: SHAP waterfall plot for a representative attack instance in CICIDS-2017 (LightGBM, combined features). Each bar shows the SHAP contribution of one feature; MDE features (jsd_pkt_len, dir_entropy_pkts,flag_entropy) rank among the strongest drivers of the attack prediction. discriminative power throughout all tested noise levels. This graceful degradation behavior is consistent with the information- theoretic nature of the features. Entropy is a smooth function of distribution parameters, so small perturbations produce bounded entropy changes. A 25% noise injection corresponds to a severe degradation scenario that substantially exceeds typical measure- ment variability in flow-record generation tools. 6.11 Entropy vs. Simple Statistics A necessary test of whether MDE features add genuine informa- tion is to compare them against the raw numerical statistics from which they are derived. Table 10 compares LightGBM with entropy-only MDE features against a simple-statistics baseline that uses the corresponding raw columns directly (packet-length means/stds, IAT means/stds, flow rates, byte counts) without Page 14 of 20 Research ArticleBouke et al., 2026. 1050510 38 other features 0 = dmeansz 0 = is_sm_ips_ports 7 = ct_dst_ltm 0 = dbytes 0.693 = jsd_iat 17 = ct_srv_src 114 = sbytes 7 = ct_src_ ltm 0 = synack 17 = ct_srv_dst 2 = service 4 = ct_dst_sport_ltm 254 = sttl 2 = ct_state_ttl 38 other features dmeansz is_sm_ips_ports ct_dst_ltm dbytes jsd_iat ct_srv_src sbytes ct_src_ ltm synack ct_srv_dst service ct_dst_sport_ltm sttl ct_state_ttl +12.84 +6.95 +1.74 +1.01 +0.25 +0.2 +0.14 +0.11 +0.08 +0.07 +0.07 +0.09 0.11 0.07 0.06 E[f(X)] =10.883 f(x) = 12.439 SHAP Waterfall (Attack) UNSW-NB15 Figure 10: SHAP waterfall plot for a representative attack instance in UNSW-NB15 (LightGBM, combined features). Lowade_src_iat (highly regular inter-arrival timing) and asymmetricjsd_pkt_szare the primary attack drivers, consistent with automated scanner behavior. Table 9: Entropy-only LightGBM F1-score under additive Gaussian noise (Δ= fraction of per-feature std). Clean baseline (Δ = 0) shown for reference. DatasetΔ = 0 Δ = 0.05 Δ = 0.10 Δ = 0.25 NSL-KDD0.9790.8900.8590.819 CIC-20170.9550.8180.7840.748 UNSW-NB15 0.9890.9670.9590.940 any entropy transformation. The number of features in both conditions is comparable (â€12). Simple statistics achieve comparable or slightly higher stan- dalone F1 on NSL-KDD and CICIDS-2017, where raw packet- count and byte-rate features are direct discriminators for volume- based attacks. On UNSW-NB15, both feature sets are equiv- alent, indicating that the entropy transformation captures the same discriminative information as the raw jitter and load fea- tures. The entropy transformation does not consistently improve standalone F1 over raw input statistics. The contribution is in representation grounding. Each MDE feature is defined by an information-theoretic formula (Propositions 1â2), applies uniformly across heterogeneous schemas, and receives domain- interpretable SHAP attributions with cross-fold rank stability, as shown in Section 6.14. 6.12 Per-Class Detection Table 11 reports per-category DR and FAR for LightGBM on the combined feature set across three evaluation conditions: (i) random 20% hold-out on NSL-KDD and CICIDS-2018, and (i) the CICIDS-2017 temporal split (MonâThu train, Friday test). These conditions reveal meaningfully different failure profiles. Under random hold-out, NSL-KDD achieves DR=0.986, mde_score Feature CICIDS-2017 CICIDS-2018 NSL-KDD UNSW-NB15 Dataset 0.115 -0.032 0.153 -0.138 MDE Score (Attack Benign) per Dataset 0.10 0.05 0.00 0.05 0.10 0.15 Figure 11: MDE score delta (AttackâBenign mean) per dataset. The sign reversal between environments reveals that attack entropy signa- tures are environment-dependent, motivating cross-dataset evaluation. Table 10: Entropy-only MDE vs. raw simple-statistics baseline (Light- GBM, 5-fold CV, comparable feature count). Simple statistics for each dataset are the raw numerical columns from which MDE entropy values are derived (packet-length means/stds, IAT stds, packet counts, byte rates). âF1 = MDEâ simple. DatasetFeature setn f F1âF1 NSL-KDDSimple statistics10 0.983 â0.004 Entropy-only (MDE)7 0.979 CIC-2017Simple statistics12 0.982 â0.027 Entropy-only (MDE) 12 0.955 UNSW-NB15 Simple statistics10 0.988 <0.001 Entropy-only (MDE) 11 0.988 FAR=0.013, consistent with aggregate F1=0.987. CICIDS- 2018 is considerably harder: DR=0.498 and FAR=0.172 align with aggregate F1=0.74, reflecting class ambiguity as a genuine dataset-level property rather than an evaluation artifact. The temporal evaluation on CICIDS-2017 reveals the most in- formative failure pattern: Bot traffic (n=329) is completely undetected (DR=0.000) because no Bot flows appear in Monâ Thu training; DDoS achieves only DR=0.182 because Fridayâs DDoS tool profile differs from MonâThu DoS attacks; PortScan is essentially missed (DR=0.001) for the same reason. The benign FAR remains very low (0.000), indicating the model defaults to predicting benign when no matching pattern is found in training, rather than generating false alarms. This pattern is a textbook example of distribution shift between training and deployment traffic, and motivates domain-adaptive recalibration as future work. 6.13 Unseen Attack Families To test MDE beyond random stratified CV, we conduct an unseen-attack-family evaluation on CICIDS-2017. A Light- GBM and Random Forest model are trained on all attack fam- ilies except two held-out families (Infiltration and Bot), then Page 15 of 20 Research ArticleBouke et al., 2026. Table 11: Per-category detection rates (LightGBM, combined MDE features). NSL-KDD and CICIDS-2018 use a random stratified 20% hold-out; CICIDS-2017 uses the temporal split (MonâThu trainâFriday test). DR = fraction of attack flows correctly predicted as attack; FAR = fraction of benign flows incorrectly predicted as attack. Dataset / SplitCategoryn test DRFAR NSL-KDD (random)Attack (binary)2,567 0.986n/a Benign1,942n/a 0.013 CICIDS-2018 (random) Attack (binary)8,434 0.498n/a Benign21,566n/a 0.172 CIC-2017 (temporal)DDoS18,888 0.182n/a PortScan18,480 0.001n/a Bot329 0.000n/a Benign62,303n/a 0.000 evaluated on flows from only those two families plus a matched benign set. This simulates the operationally realistic scenario where a deployed IDS encounters attack types not seen during training. DR=0.000 for all conventional and combined models on held- out Infiltration and Bot traffic, while weighted F1 remains above 0.998, driven entirely by the 99.9% benign majority. No feature engineering approach generalizes to structurally novel fami- lies without retraining. Infiltration (n=2) mimics legitimate HTTP sessions; Bot (n=157) uses low-frequency C&C chan- nels; both are structurally unlike the DoS and scan traffic in train- ing. The entropy-only condition recovers marginal detection (DR=0.0063) at FAR=0.053â0.061, insufficient for operational use. LightGBM conventional achieves AUC=0.755 versus RFâs 0.431, showing that the ranking function retains partial ordering even when threshold-level decisions fail completely. This gap between DR and AUC is a methodological caution. High AUC does not imply operational detection capability when novel attack families are present. 6.14 SHAP Fold Stability To quantify the consistency of SHAP attributions across cross- validation folds (rather than relying solely on qualitative visual inspection), we compute, for each of the 5 CV folds: (i) the mean absolute SHAP value per feature on the held-out test fold, (i) the Spearman rank correlation between each pair of folds, and (i) the KendallÏfor robustness. Table 13 reports results for three representative datasets (NSL-KDD, CICIDS-2017, UNSW-NB15). All-feature SHAP rankings are moderately to strongly consistent across folds: SpearmanÏ = 0.95(NSL-KDD),0.93(CICIDS- 2017), and0.80(UNSW-NB15). MDE-only rankings are more variable (Ï = 0.26â0.69), reflecting the small feature count (n = 7â12) and the sensitivity of pairwise Spearman correlation to rank swaps among similarly-valued features. The MDE rank std (4.2â8.2 positions) quantifies this within-dataset variability. The aggregate MDE contribution to SHAP is stable, but fine- grained ordering among individual MDE features varies, as expected when correlated entropy features (ADE and JSD share packet-size inputs) exchange rank positions without materially changing the overall importance profile. 6.15 Computational Profiling Table 14 reports training time and per-sample inference latency for LightGBM and Random Forest on the combined MDE fea- ture set. All measurements use a single CPU core (n_jobs=1) on an Intel-class processor. Inference latency is reported in mi- croseconds per sample to assess real-time viability. A threshold of 100ÎŒs/sample (10K flows/second) is considered acceptable for network monitoring appliances. LightGBM inference latency ranges from 4.9â5.9ÎŒs/sample across all four datasets (single-threaded), corresponding to a throughput of 169Kâ205K flows/second, which is well within real-time requirements for network monitoring appliances. Training time scales with dataset size as expected (0.45â11.69 seconds for LightGBM; 1.58â100 seconds for RF at 265K train- ing samples). The compact MDE feature set (7â12 entropy features vs. 42â79 for full CICFlowMeter) contributes to the low inference latency since each MDE feature is a closed-form formula computed from existing flow statistics without addi- tional feature extraction overhead. 7 Discussion The results are interpreted across four dimensions: the nature of MDEâs contribution relative to conventional features, the operational failure patterns exposed by full metric reporting, the consistency of entropy-feature attributions, and the approxima- tion boundaries that govern when MDE is and is not applicable. 7.1 What MDE Actually Contributes Combined and conventional conditions achieve comparable within-distribution F1 across all datasets (Table 2); the entropy transformation does not consistently improve discriminative power over conventional features. The contribution is therefore in representation quality and evaluation methodology. Entropy features are grounded in specific behavioral claims (Propo- sitions 1â2), apply uniformly across heterogeneous schemas without retraining, and receive reproducible SHAP attributions (Ï = 0.80â0.95) that align with those propositions. The leakage- free fold-local protocol with full operational metrics (DR, FAR, MCC, PR-AUC) surfaces failure modes that aggregate F1 alone would conceal. 7.2 Operational Realism The temporal and unseen-family evaluations reveal two failure patterns that aggregate F1 conceals. Under temporal distribution shift, discriminative score ordering is preserved (AUC=0.87) while fixed thresholds collapse (DR=0.082), a pattern termed threshold-ranking divergence, which points to adaptive recal- ibration as the practical path forward. Under unseen attack families, DR=0 for all feature conditions regardless of model; F1>0.998 is driven entirely by the majority-class prior. Nei- ther failure is MDE-specific. Conventional features fail identi- cally [23]. The implication is that any discriminative representa- tion requires domain-matched training and periodic threshold recalibration. MDEâs compact feature set (7â12 features vs. 42â79 conventional) reduces the cost of both. 7.3 Stability and Interpretability The fold-stability analysis (Section 6.14) shows that SHAP rank- ings are reproducible across data splits: SpearmanÏ = 0.80â Page 16 of 20 Research ArticleBouke et al., 2026. Table 12: Unseen-attack-family evaluation: trained on CICIDS-2017 without Infiltration and Bot, tested on those held-out families plus matched benign (n attack =159,n benign =182,177). Prec/Rec are weighted; DR is computed on held-out attacks, FAR on benign. All conventional and combined models achieve DR=0.000, confirming genuine distribution shift. ModelAblationF1PrecRecAUCDRFAR LightGBMconventional0.9984 0.9983 0.9985 0.7553 0.0000 0.0006 entropy_only 0.9715 0.9982 0.9462 0.5547 0.0063 0.0530 combined0.9984 0.9983 0.9985 0.7494 0.0000 0.0006 RandomForest conventional0.9981 0.9983 0.9979 0.4307 0.0000 0.0013 entropy_only 0.9673 0.9982 0.9382 0.3825 0.0063 0.0610 combined0.9981 0.9983 0.9979 0.6829 0.0000 0.0012 Table 13: SHAP rank stability across 5 CV folds (LightGBM, combined features).Ï all /Ï MDE = Spearman rank correlation over all features / MDE-only features, mean±std across 5 2 =10 fold pairs.Ï K = KendallâsÏ(all features). MDEÏ r = mean rank-position std of MDE features across folds. DatasetÏ all Ï MDE Ï K MDE Ï r NSL-KDD0.950± 0.015 0.257± 0.265 0.853± 0.0144.24 CICIDS-2017 0.927± 0.022 0.690± 0.200 0.814± 0.0228.18 UNSW-NB150.800± 0.052 0.413± 0.353 0.649± 0.0526.98 Table 14: Computational profiling: training time and per-sample in- ference latency (combined MDE features, single-threaded CPU, 80/20 stratified split). A threshold of 100ÎŒs/sample (10K flows/s) is used as a deployment viability criterion. All results are well below this threshold. DatasetModeln train Train (s) Infer (ÎŒ s/flow) NSL-KDDLightGBM18,0350.454.85 RandomForest18,0351.5812.25 CIC-2017LightGBM181,4898.135.93 RandomForest 181,48956.0513.85 CIC-2018LightGBM264,90011.695.80 RandomForest 264,900100.1119.34 UNSW-NB15 LightGBM239,9996.715.33 RandomForest 239,99935.515.61 0.95for all-feature models, KendallÏ = 0.65â0.85. JSD fea- tures rank among the top-3 contributors on CICIDS-2017, UNSW-NB15, and NSL-KDD; ADE features appear in the top-5 across all three datasets. This is consistent with the behavioral- asymmetry propositions (Propositions 1â2) and with the wa- terfall analysis showingjsd_pkt_len=0.693 as the primary driver for highly unidirectional attack flows. Stable attribution confirms that the model consistently relies on JSD features, though SHAP does not independently verify the Gaussian dis- tributional assumptions. The MDE-only rankings show higher variance (Ï MDE = 0.26â0.69), expected given the small feature count and correlation structure (ADE and JSD share packet-size inputs). 7.4 Approximation Limits and Transfer Gap The stable attributions in Section 7 above are predicated on the Gaussian approximation underlying ADE and JSD. This subsection examines when that approximation is adequate and where it breaks down. Flow statistics exhibit substantial non- Gaussianity (skewness 1.5â9.7, excess kurtosis 0.9â110.2), so ADE is a Gaussian lower bound on true entropy rather than an exact estimate. For discriminative use this is acceptable as long as monotone ordering is preserved: ADE consistently underesti- mates entropy, but because the bias applies in the same direction across flows, the relative gap between attack and benign clusters is preserved. The noise robustness experiments support this. At Δ = 0.25(25% Gaussian noise), F1 remains above 0.82 across all datasets, indicating that inter-class entropy margins are sub- stantially larger than the approximation error. The cross-dataset transfer gap (CIC-2017 to CIC-2018: F1 drops from 0.955 to 0.591) reflects attack-family-specific entropy signatures and appears equally for conventional features [23]. This behavior is a property of discriminative representations generally, not a limitation unique to entropy. 7.5 Limitations The Gaussian ADE approximation underestimates entropy for multimodal flows and encrypted traffic; non-parametric esti- mators (kernel density, RĂ©nyi) are natural successors. Entropy signatures require recalibration when attack taxonomies change. Zero-shot F1 drops to 0.59â0.74 and unseen-family DR=0, as shown by the transfer and unseen-family evaluations. Stan- dard stratified CV allows campaign-correlated flows across train and test folds; host-based or session-level isolation would of- fer stricter distribution guarantees than temporal splits alone. All results are specific to four controlled benchmark datasets; validation on live organizational traffic is required before any operational deployment claim can be made. 8 Conclusion MDE derives 7â12 interpretable entropy features analytically from pre-aggregated flow statistics, requiring no raw packet ac- cess, training data, or architecture choices. Within-distribution cross-validation performance is statistically indistinguishable between combined and conventional features, confirming that the entropy transformation does not degrade aggregate discrimi- native power; its contribution is in representation grounding and evaluation methodology. Three evaluation protocols expose failure modes that aggre- gate F1 structurally cannot reveal. First, full operational metric reporting shows that CICIDS-2018 F1=0.74 masks a DR of only 0.48, so fewer than half of attacks are detected, a gap that F1 alone hides under class imbalance. Second, an unseen- attack-family experiment on CICIDS-2017 demonstrates that F1 exceeds 0.998 while DR=0 for held-out Infiltration and Bot families; the aggregate score is driven entirely by the 99.9% benign majority and provides no signal about detection capa- bility on novel threats. Third, a pseudo-live temporal replay evaluation, in which the trained pipeline is frozen and 703K Fri- day flows are replayed chronologically without retraining, iden- tifies threshold-ranking divergence: AUC remains 0.73â0.87 while DR collapses to 0.08â0.13 across all feature conditions, Page 17 of 20 Research ArticleBouke et al., 2026. and Youdenâs-J threshold recalibration provides no recovery because the full attack score distribution shifts below any thresh- old derived from training data. Window-level analysis reveals that during DDoS surge periods, DR reaches zero while AUC reaches 0.95, confirming that score calibration fails indepen- dently of score discrimination. SHAP fold-stability analysis (SpearmanÏ = 0.80â0.95) con- firms that JSD and ADE features receive reproducible, domain- coherent attributions across heterogeneous environments. Future directions include non-parametric entropy estimation for heavy-tailed and encrypted flows, learned threshold recal- ibration for taxonomy-adaptive deployment, campaign-aware cross-validation, and validation on live organizational traffic. Declarations âą Funding: Not applicable. âą Conflict of Interest: The authors declare no competing interests. âąAvailability of Data and Materials: All four datasets are publicly available (NSL-KDD, CICIDS-2017, CICIDS- 2018, UNSW-NB15). The full experimental pipeline, in- cluding preprocessing, MDE feature extraction, model training, and SHAP analysis, is available as open-source code at https://github.com/drbouke/mde. âą Ethics Approval: Not applicable. References [1]A. Khraisat, I. Gondal, P. Vamplew, and J. Kamruzza- man, âSurvey of intrusion detection systems: Techniques, datasets and challenges,â Cybersecurity, vol. 2, no. 1, p. 20, 2019. DOI: 10.1186/s42400-019-0038-7 [2]M. Ring, S. Wunderlich, D. Scheuring, D. Landes, and A. Hotho, âA survey of network-based intrusion detection data sets,â Computers & Security, vol. 86, p. 147â167, 2019. DOI: 10.1016/j.cose.2019.06.005 [3]M. A. Bouke, O. I. Alramli, and A. Abdullah, âEntropy mixing networks: Enhancing pseudorandom number gen- erators with lightweight dynamic entropy injection,â Jour- nal of Security and Privacy, vol. 9, no. 1, e70172, 2026. DOI: 10.1002/spy2.70172 [4]S. M. Pincus, âApproximate entropy as a measure of sys- tem complexity,â Proceedings of the National Academy of Sciences USA, vol. 88, no. 6, p. 2297â2301, 1991. DOI: 10.1073/pnas.88.6.2297 [5]J. S. Richman and J. R. Moorman, âPhysiological time- series analysis using approximate entropy and sample entropy,â American Journal of Physiology: Heart and Circulatory Physiology, vol. 278, no. 6, H2039âH2049, 2000. DOI:10.1152/ajpheart.2000.278.6. H2039 [6]M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, âA detailed analysis of the KDD CUP 99 data set,â in Pro- ceedings of the 2nd IEEE Symposium on Computational Intelligence for Security and Defence Applications, 2009, p. 1â6. DOI: 10.1109/CISDA.2009.5356528 [7] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, âTo- ward generating a new intrusion detection dataset and intrusion traffic characterization,â in Proceedings of the 4th International Conference on Information Systems Se- curity and Privacy, 2018, p. 108â116. DOI:10.5220/ 0006639801080116 [8] N. Moustafa and J. Slay, âUNSW-NB15: A comprehen- sive data set for network intrusion detection systems,â in Proceedings of the Military Communications and In- formation Systems Conference, 2015, p. 1â6. DOI:10. 1109/MilCIS.2015.7348942 [9] M. A. Bouke, O. I. Alramli, and A. Abdullah, âXAIRF- WFP: A novel XAI-based random forest classifier for advanced email spam detection,â International Journal of Information Security, vol. 24, no. 1, p. 5, 2025. DOI: 10.1007/s10207-024-00920-1 [10]M. A. Bouke et al., âA novel LightGBM model for Arabic spam detection integrated with XAI for enhanced explain- ability,â Computers and Electrical Engineering, vol. 133, p. 111 032, 2026. DOI:10.1016/j.compeleceng. 2026.111032 [11] S. M. Lundberg and S.-I. Lee, âA unified approach to interpreting model predictions,â in Advances in Neural Information Processing Systems, vol. 30, 2017, p. 4766â 4777. [12]S. M. Lundberg, G. G. Erion, and S.-I. Lee, âConsistent individualized feature attribution for tree ensembles,â in arXiv preprint arXiv:1802.03888, 2018. [13]G. Engelen, V. Rimmer, and W. Joosen, âTroubleshooting an intrusion detection dataset: The CICIDS2017 case study,â IEEE Security & Privacy, vol. 19, no. 4, p. 26â 35, 2021. DOI: 10.1109/MSEC.2021.3068460 [14]A. Thakkar and R. Lohiya, âA survey on intrusion de- tection system: Feature selection, model, performance measures, application perspective, challenges, and fu- ture research directions,â Artificial Intelligence Review, vol. 55, p. 453â563, 2022. DOI:10.1007/s10462- 021-10037-9 [15]O. H. Abdulganiyu, T. A. Tchakoucht, and Y. K. Sa- heed, âA systematic literature review for network intru- sion detection system (IDS),â International Journal of Information Security, vol. 22, p. 1125â1162, 2023. DOI: 10.1007/s10207-023-00682-2 [16]P. Wu and H. Guo, âRTIDS: A robust transformer-based approach for intrusion detection system,â IEEE Access, vol. 10, p. 65 259â65 270, 2022. DOI:10 . 1109 / ACCESS.2022.3184120 [17] H. Kheddar et al., âTransformers and large language mod- els for efficient intrusion detection systems: A compre- hensive survey,â Information Fusion, vol. 124, p. 102 820, 2025. DOI: 10.1016/j.inffus.2025.102820 [18] Z. Zhong, S. Chen, J. Qiu, et al., âA survey on graph neural networks for intrusion detection systems: Methods, trends and challenges,â Computers & Security, vol. 141, p. 103 821, 2024. DOI:10.1016/j.cose.2024. 103821 [19] O. E. Buyuktanir et al., âFederated learning in intrusion detection: Advancements, applications, and future direc- Page 18 of 20 Research ArticleBouke et al., 2026. tions,â Cluster Computing, vol. 28, p. 473, 2025. DOI: 10.1007/s10586-025-05325-w [20]G. Apruzzese, P. Laskov, and J. Schneider, âSok: The impact of unlabelled data in cyberthreat detection,â IEEE Security & Privacy, vol. 21, no. 5, p. 52â61, 2023. DOI: 10.1109/MSEC.2022.3165612 [21]B. A. Tama and K.-H. Rhee, âAn in-depth experimen- tal study of anomaly detection using gradient boosted machine,â Neural Computing and Applications, vol. 31, p. 955â965, 2019. DOI:10.1007/s00521-017- 3128-z [22] O. Faker and E. Dogdu, âIntrusion detection using big data and deep learning techniques,â Proceedings of the 2019 ACM Southeast Conference, p. 86â93, 2019. DOI: 10.1145/3299815.3314439 [23]M. Sarhan, S. Layeghy, N. Moustafa, and M. Portmann, âNetflow datasets for machine learning-based network in- trusion detection systems,â in Proceedings of the 10th In- ternational Conference on Big Data Technologies, 2021, p. 9â21. DOI:10.1007/978-3-030-96566-2_2 [24] A. Tori et al., âAn evaluation framework for network in- trusion detection datasets: Leveraging MITRE ATT&CK and industry relevance metrics,â Computers & Security, p. 104 663, 2025. DOI:10.1016/j.cose.2025. 104663 [25] A. Wagner and B. Plattner, âEntropy based worm and anomaly detection in fast IP networks,â in Proceedings of the 14th IEEE International Workshops on Enabling Tech- nologies, 2005, p. 172â177. DOI:10.1109/WETICE. 2005.35 [26] G. Nychis, V. Sekar, D. G. Andersen, H. Kim, and H. Zhang, âAn empirical evaluation of entropy-based traf- fic anomaly detection,â in Proceedings of the 8th ACM SIGCOMM Conference on Internet Measurement, 2008, p. 151â156. DOI: 10.1145/1452520.1452539 [27]K. Xu, Z.-L. Zhang, and S. Bhattacharyya, âProfiling internet backbone traffic: Behavior models and appli- cations,â in Proceedings of ACM SIGCOMM, 2005, p. 169â180. DOI: 10.1145/1080091.1080112 [28]A. Kenyon et al., âCharacterising payload entropy in packet flows: Baseline entropy analysis for network anomaly detection,â Future Internet, vol. 16, no. 12, p. 470, 2024. DOI: 10.3390/fi16120470 [29]X. Yu et al., âRenyi entropy-driven network traffic anomaly detection with dynamic threshold,â Cyberse- curity, vol. 7, p. 64, 2024. DOI:10.1186/s42400- 024-00249-1 [30] B. Mahbooba, M. Timilsina, R. Sahal, and M. Serrano, âExplainable artificial intelligence (XAI) to enhance trust management in intrusion detection systems using deci- sion tree model,â Complexity, vol. 2021, p. 6 634 811, 2021. DOI: 10.1155/2021/6634811 [31]R. Patil, G. Dudeja, and C. Modi, âDesigning an efficient security framework for detecting intrusions in virtual network of cloud computing,â Computers & Security, vol. 113, p. 102 537, 2022. DOI:10.1016/j.cose. 2021.102537 [32] S. U. Khan et al., âExplainable AI-based intrusion de- tection systems for Industry 5.0 and adversarial XAI: A systematic review,â Information, vol. 16, no. 12, p. 1036, 2025. DOI: 10.3390/info16121036 [33]M. A. Bouke et al., âApplication of BukaGini algorithm for enhanced feature interaction analysis in intrusion de- tection systems,â PeerJ Computer Science, vol. 10, e2043, 2024. DOI: 10.7717/peerj-cs.2043 [34]C. E. Shannon, âA mathematical theory of communica- tion,â The Bell System Technical Journal, vol. 27, no. 3, p. 379â423, 1948. DOI:10.1002/j.1538-7305. 1948.tb01338.x [35]T. M. Cover and J. A. Thomas, âElements of informa- tion theory,â Wiley-Interscience, 1991. DOI:10.1002/ 047174882X [36]J. Lin, âDivergence measures based on the Shannon en- tropy,â IEEE Transactions on Information Theory, vol. 37, no. 1, p. 145â151, 1991. DOI: 10.1109/18.61115 [37]G. Ke et al., âLightGBM: A highly efficient gradient boosting decision tree,â in Advances in Neural Informa- tion Processing Systems, vol. 30, 2017, p. 3149â3157. [38] L. Breiman, âRandom forests,â Machine Learning, vol. 45, no. 1, p. 5â32, 2001. DOI:10.1023/A: 1010933404324 [39]D. Chicco and G. Jurman, âThe advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation,â BMC Genomics, vol. 21, no. 1, p. 6, 2020. DOI:10.1186/ s12864-019-6413-7 [40]T. Fawcett, âAn introduction to ROC analysis,â Pattern Recognition Letters, vol. 27, no. 8, p. 861â874, 2006. DOI: 10.1016/j.patrec.2005.10.010 [41]T. Saito and M. Rehmsmeier, âThe precision-recall plot is more informative than the ROC plot when evaluating binary classifiers on imbalanced datasets,â in PLOS ONE, vol. 10, 2015, e0118432. DOI:10.1371/journal. pone.0118432 [42] F. Wilcoxon, âIndividual comparisons by ranking meth- ods,â Biometrics Bulletin, vol. 1, no. 6, p. 80â83, 1945. DOI: 10.2307/3001968 [43]L. Prokhorenkova, G. Gusev, A. Vorobev, A. V. Doro- gush, and A. Gulin, âCatBoost: Unbiased boosting with categorical features,â in Advances in Neural Information Processing Systems (NeurIPS), vol. 31, 2018. [44]S. Ă. Arik and T. Pfister, âTabNet: Attentive interpretable tabular learning,â in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 35, 2021, p. 6679â6687. [45]Y. Gorishniy, I. Rubachev, V. Khrulkov, and A. Babenko, âRevisiting deep learning models for tabular data,â in Advances in Neural Information Processing Systems (NeurIPS), vol. 34, 2021, p. 18 932â18 943. [46]L. Grinsztajn, E. Oyallon, and G. Varoquaux, âWhy tree- based models still outperform deep learning on tabular data,â in Advances in Neural Information Processing Systems (NeurIPS), vol. 35, 2022, p. 507â520. [47] H. Liu and B. Lang, âMachine learning and deep learn- ing methods for intrusion detection systems: A survey,â Applied Sciences, vol. 9, no. 20, p. 4396, 2019. DOI: 10.3390/app9204396 [48]S. M. Kasongo and Y. Sun, âA deep learning method with wrapper based feature extraction for wireless intru- Page 19 of 20 Research ArticleBouke et al., 2026. sion detection system,â Computers & Security, vol. 92, p. 101 752, 2020. DOI:10.1016/j.cose.2020. 101752 Page 20 of 20