Enhancing Machine Learning-Based Intrusion Detection with Chebyshev-Driven Feature Engineering

The increasing sophistication of network attacks poses a significant challenge to modern cybersecurity. While machine learning (ML) models have become essential for network intrusion detection systems (NIDS), their performance is heavily dependent on the quality and representation of input features. This paper introduces a novel feature engineering technique to enhance the efficacy of ML-based attack detection. We propose the creation of a “Chebyshev Anomaly Score,” a statistical feature derived from Chebyshev’s inequality, which quantifies the abnormality of a given network flow without making assumptions about the data’s underlying distribution. This score is integrated as a new feature into a suite of ML models, including Random Forest, LightGBM, and a Multi-Layer Perceptron (MLP). Using the modern OD-IDS2022 dataset, we conduct a rigorous evaluation with 5-fold cross-validation. Our results demonstrate that the inclusion of the Chebyshev Anomaly Score yields a statistically significant improvement in F1-score across all tested models (p < 0.05). Notably, the Random Forest model, enhanced with our feature, achieved a mean F1-score of 0.9938, ranking the proposed feature among the most important for classification. This work demonstrates that hybridizing statistical anomaly metrics with ML models is a promising direction for developing more robust and effective intrusion detection systems.