Cluster preserving recursive feature elimination framework for intrusion detection in smart industry systems

Abstract

Abstract Cyber-physical systems, Industrial IoT, and Industry 4.0 infrastructures are converging rapidly, due to which the attack surface of industrial environments has grown substantially. Intrusion Detection Systems (IDS) are now central to operational security, yet conventional approaches still struggle, false-positive rates remain high, distinguishing genuine cyberattacks from ordinary industrial anomalies is difficult, and the computational cost of running large models often makes deployment on resource-constrained edge devices impractical. Data scarcity compounds the problem further, since labeling representative industrial attack traffic is expensive and slow. Feature selection methods such as Recursive Feature Elimination (RFE) help by reducing dimensionality, but they evaluate features one at a time and so tend to miss the higher-order interactions between features that often carry the strongest signal for identifying attacks. This paper introduces D-FOCUS-X, a Feature-Interaction-Aware Recursive Feature Elimination (FIA-RFE) framework built specifically to capture and preserve these inter-feature dependencies during selection rather than discarding them. Its core mechanism combines an interaction-aware scoring step with a cluster-preserving elimination strategy, so that groups of features which work together discriminatively are kept intact even as redundant attributes are pruned away. The result is a compact feature set that retains the information needed for accurate detection while being light enough for industrial edge deployment. On the CICIDS2017 benchmark, D-FOCUS-X reduces the original 78-dimensional feature space down to just 27 features a 65.4% reduction without sacrificing detection performance. Random Forest (RF) and XGBoost both reach 99.9% classification accuracy on this reduced set, outperforming conventional RFE, SelectKBest, and Information Gain. All results were obtained under a strictly leakage-free pipeline, and 10-fold cross-validation confirms stable generalization, with standard deviation below 0.003 across all classifiers. Together, these findings position D-FOCUS-X as a practical and computationally efficient feature selection approach for next-generation industrial IDS.