On the Impact of Entropy-based Features

2026-07-16

AI Summary

Traditional statistical features often fail to adequately capture the complex and dynamic nature of network traffic, thereby limiting the performance of anomaly detection systems. To address this limitation, this work proposes incorporating entropy as a lightweight and interpretable supplementary feature to quantify the variability of traffic attributes. The entropy-based feature is combined with conventional statistical features and fed into standard machine learning classifiers without replacing existing feature engineering pipelines. Experimental results on publicly available intrusion detection datasets demonstrate that this approach significantly improves classification accuracy, particularly in high-variability scenarios where it effectively reduces false positive rates. Moreover, the method incurs minimal computational overhead, offering a practical and scalable solution for real-world deployment.

Abstract

Network anomaly detection is increasingly challenging due to the growing diversity and variability of traffic patterns, which are not always well captured by traditional statistical features. In this work, we explore the use of entropy as an additional feature to support supervised network traffic classification. The main idea is to use entropy to represent variability in selected traffic attributes, complementing conventional descriptors rather than replacing them. We integrate the entropy-based feature into a standard machine learning pipeline and evaluate its impact through a direct comparison between models trained with and without this feature. Experiments conducted on a public intrusion detection dataset show consistent improvements in classification performance, while the additional computational cost remains low. The analysis of confusion matrices indicates a reduction in misclassifications, especially in traffic scenarios with higher variability. Overall, the results suggest that entropy-based features offer a simple and practical way to enhance existing anomaly detection pipelines. This approach is particularly attractive in settings where lightweight feature engineering and interpretability are important, making entropy a useful complement to commonly used traffic features.

Problem

• network anomaly detection
• traffic variability
• entropy-based features
• statistical features
• intrusion detection

Innovation

• entropy-based features
• network anomaly detection
• traffic variability
• supervised classification
• feature engineering