MFRR-CEF: Overlap- and Entropy-Aware Feature Ranking With Calibrated Ensemble Fusion For Imbalanced Multiclass Iot Intrusion Detection

Abstract

Internet of Things intrusion detection involves accurate identification of rare attack classes in the presence of skewed traffic distributions, redundant flow attributes, overlapping behaviors, noisy measurements, and changing class priors. A classifier with high aggregate accuracy may miss theft, ransomware, man-in-the-middle, or backdoor traffic if those classes constitute a small proportion of the observations. This paper introduces MFRR-CEF, an overlap and entropy-aware feature ranking framework with calibrated ensemble fusion for multiclass intrusion detection on the NF-BoT-IoT and NF-ToN-IoT NetFlow benchmarks. The processing pipeline consists of six interconnected steps: leakage-safe flow preparation, robust outlier control, Multi-Class Feature Rank Ratio Plus (MFRR+) scoring, boundary-guarded class balancing, an entropy-weighted novel support vector classifier (NSVC), an enhanced Rotation Forest (ERF), and validation-calibrated diversity fusion. MFRR+ integrates pairwise standardized class separation, density overlap, class rarity, label entropy, and correlation redundancy into a single bounded score. The balancing phase only allows a synthetic minority sample if the local class geometry and a margin test support its label. NSVC assigns class-sensitive costs to one-versus-one margins, and ERF creates supervised feature groups whose retained principal directions are geared towards between-class variation. Fusion weights are derived from inner-fold macro F1, calibration loss, and pairwise error diversity. Six algorithms and corresponding propositions define bounded ranking, preservation of neighborhoods of accepted samples, minority-sensitive margin allocation, orthonormal rotation, convex fusion risk, and leakage isolation. Public class distribution indicates severe skew: NF-BoT-IoT has 470,655 reconnaissance flows but only 1,909 theft flows and NF-ToN-IoT has 468,539 injection flows but only 142 ransomware flows. Compared to the best reported baseline, MFRR-CEF obtains the comparative experiment accuracy of 0.989 and precision of 0.990, while the best reported baseline gets the precision of 0.985 and the experiment accuracy of 0.980. A distinct 699-instance pilot record is an improvement from 674 to 687 correct decisions, which translate to accuracies of 0.9642 and 0.9828 as well as Wilson intervals of [0.9477, 0.9757] and [0.9702, 0.9902]. Therefore, fold-level predictions are not available and comparative significance is not claimed. The architecture, pilot interpretation, error controls, and nested evaluation scheme together give a reproducible framework for a full multiclass benchmark.