An Extended Evaluation of Feature Selection and Enrichment Impact on Intrusion Detection Systems for Smart Grids

• Vagner E. Quincozes UFF
• Silvio E. Quincozes UNIPAMPA
• Célio Albuquerque UFF
• Diego Passos ISEL
• Daniel Mossé PITT

DOI: https://doi.org/10.5753/sbseg.2025.11454

Abstract

This work evaluates the impact of feature selection and enrichment on the performance of intrusion detection systems (IDS) for smart grids. Seven feature sets were tested, ranging from basic to enriched versions, including two application orders: (i) selection after enrichment and (ii) enrichment after selection. Effectiveness was assessed across seven types of cyberattacks with varying complexity, using lightweight classifiers. The results show that feature selection improves detection in simpler attacks, such as Random Replay and Inverse Replay, while enrichment enhances performance in more complex scenarios, such as Masquerade Fake Fault. The best results were obtained by combining both techniques, especially when enrichment was applied before selection — which helped preserve critical derived features, such as delay.

References

Bragança, H., Rocha, V., Souto, E., Kreutz, D., and Feitosa, E. (2023). Explaining the effectiveness of machine learning in malware detection: Insights from explainable ai. In Simpósio Brasileiro de Segurança da Informação e de Sistemas Computacionais (SBSeg), pages 181–194. SBC.

Horchulhack, P., Viegas, E. K., Santin, A. O., and Geremias, J. (2022). Atualizaçao de modelo baseado em aumento de dados e transferência de aprendizagem para detecçao de intrusao em redes. In Simpósio Brasileiro de Segurança da Informação e de Sistemas Computacionais (SBSeg), pages 223–235. SBC.

Kaushik, B., Sharma, R., Dhama, K., Chadha, A., and Sharma, S. (2023). Performance evaluation of learning models for intrusion detection system using feature selection. Journal of Computer Virology and Hacking Techniques, 19(4):529–548.

Latif, N., Ma, W., and Ahmad, H. B. (2025). Advancements in securing federated learning with ids: a comprehensive review of neural networks and feature engineering techniques for malicious client detection. Artificial Intelligence Review, 58(3):91.

Li, J., Othman, M. S., Chen, H., and Yusuf, L. M. (2024). Optimizing IoT intrusion detection system: feature selection versus feature extraction in machine learning. Journal of Big Data, 11(1):36.

Lundberg, S. M. and Lee, S.-I. (2017). A unified approach to interpreting model predictions. Advances in neural information processing systems, 30.

Mackiewicz, R. E. (2006). Overview of IEC 61850 and Benefits. In 2006 IEEE Power Engineering Society General Meeting, pages 8–pp. IEEE.

Mariani, W. C., Munaretto, A., Fonseca, M., Lopes, H., and Silva, T. H. (2024). Detecção de intrusão e análise cyberfísica em redes industriais. In Simpósio Brasileiro de Segurança da Informação e de Sistemas Computacionais (SBSeg), pages 787–793. SBC.

Musleh, D., Alotaibi, M., Alhaidari, F., Rahman, A., and Mohammad, R. M. (2023). Intrusion detection system using feature extraction with machine learning algorithms in IoT. Journal of Sensor and Actuator Networks, 12(2):29.

Nayak, G. S., Muniyal, B., and Belavagi, M. C. (2025). Enhancing Phishing Detection: A Machine Learning Approach With Feature Selection and Deep Learning Models. IEEE Access, 13:33308–33320.

Ngo, V.-D., Vuong, T.-C., Van Luong, T., and Tran, H. (2024). Machine learning-based intrusion detection: feature selection versus feature extraction. Cluster Computing, 27(3):2365–2379.

Quincozes, S. E., Albuquerque, C., Passos, D., and Mossé, D. (2024a). ERENO: A Framework for Generating Realistic IEC–61850 Intrusion Detection Datasets for Smart Grids. IEEE Transactions on Dependable and Secure Computing, 21(4):3851–3865.

Quincozes, V. E., Quincozes, S. E., Albuquerque, C., Passos, D., and Massé, D. (2024b). Efficient feature selection for intrusion detection systems with priority queue-based GRASP. In International Conf. on Cloud Networking (CloudNet), pages 1–8. IEEE.

Quincozes, V. E., Quincozes, S. E., Passos, D., Albuquerque, C., and Mossé, D. (2024c). Towards feature engineering for intrusion detection in IEC–61850 communication networks. Annals of Telecommunications, pages 1–15.

Rabie, O. B. J., Balachandran, P. K., Khojah, M., and Selvarajan, S. (2022). A proficient ZESO-DRKFC model for smart grid SCADA security. Electronics, 11(24):4144.

Rahim, S. A. and Manoharan, A. (2024). An Optimization-based Feature Selection and Hybrid Spiking VGG 16 for Intrusion Detection in the CPS Perception layer. IEEE Access.

Sarhan, M., Layeghy, S., Moustafa, N., Gallagher, M., and Portmann, M. (2024). Feature extraction for machine learning-based intrusion detection in IoT networks. Digital Communications and Networks, 10(1):205–216.

Technologies, C. P. S. (2024). Cyber Security Report 2024. Disponível em: [link]. Acessado em: Janeiro de 2025.

Thakkar, A. and Lohiya, R. (2022). A survey on intrusion detection system: feature selection, model, performance measures, application perspective, challenges, and future research directions. Artificial Intelligence Review, 55(1):453–563.

Xi, C., Wang, H., and Wang, X. (2024). A novel multi-scale network intrusion detection model with transformer. Scientific Reports, 14(1):23239.

Zouhri, H., Idri, A., and Ratnani, A. (2024). Evaluating the impact of filter-based feature selection in intrusion detection systems. International Journal of Information Security, 23(2):759–785.