Feature Relevance is Contextual: A Class-Specific and Cross-Dataset Analysis for Network Intrusion Detection - Martins, Daniel M.; Goldschmidt, Ronaldo R.; Salles, Ronaldo M. (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais do XXVI Simpósio Brasileiro de CibersegurançaDO - 10.5753/sbseg.2026.27016, 2026)
Current Network Intrusion Detection Systems (NIDS) often rely on global feature-selection strategies, assuming feature relevance remains stable across attack classes and environments. This paper challenges this assumption, demonstrating that feature importance is contextual, sparse, and class-dependent. A class-wise and cross-dataset analysis investigates feature specialization, semantic consistency, and relevance stability. Results reveal strong intraand inter-dataset variability, where class-specific relevance discrepancies can exceed 40x for the same attribute, demonstrating that globally dominant attributes fail to preserve discriminative consistency. Preserving class-specific discriminative structures is therefore essential for next-generation NIDS.