<p>This research improves IoT attack classification by introducing a bias-aware dataset refinement strategy that eliminates IP- and port-based identifiers and applies a domain-guided hybrid feature selection framework to derive a lightweight and generalizable feature set. Motivated by the need for intrusion detection models that generalize beyond predefined network configurations, this study focuses on behavior-driven network features that enable more realistic attack categorization in IoT environments. Wrapper-based feature selection methods, including forward selection, backward elimination, and genetic algorithms, identify five optimal features. To assess the robustness of the selected feature subset, both simple classifiers (Decision Tree and KNN) and ensemble learning models, including Random Forest, Gradient Boosting, XGBoost, Bagging, and Voting Ensemble, are evaluated under binary and multi-class settings. Using the proposed reduced feature set, the Decision Tree classifier achieved an accuracy of 0.986 for binary classification and 0.972 for multi-class attack classification, while the K-Nearest Neighbor classifier consistently achieved an accuracy of 0.972 for both binary and multi-class scenarios, while ensemble models yield only marginal performance improvements. Evaluation using precision, recall, F1-score, confusion matrices, and Cohen’s Kappa confirms that the discriminative power primarily arises from the selected feature subset rather than classifier complexity. These results demonstrate that effective feature selection enables lightweight models to achieve competitive intrusion detection performance suitable for real-world IoT deployments.</p>