Modality aware feature taxonomy for robust AI driven intrusion detection across heterogeneous cyber physical data

Abstract

We investigate whether conditioning heterogeneous security metadata by semantic type—rather than applying uniform normalization—improves intrusion detection performance by up to 22.9 percentage points. To operationalize this hypothesis, we propose the Modality-Aware Feature Taxonomy (MAFT), a preprocessing framework that classifies IDS features into six semantic groups (temporal, volumetric, behavioral, identity, protocol-specific, and statistical) and applies group-appropriate normalization: robust scaling with outlier clipping for heavy-tailed volumetric features, z-score standardization for temporal measurements, and bounded scaling for categorical and identity fields. MAFT’s contribution is methodological rather than algorithmic: it formalizes IDS preprocessing as a feature-modality conditioning problem, provides a transparent taxonomy-to-scaler mapping for security metadata, and characterizes when such conditioning is likely to matter. We evaluate MAFT through a four-stage progressive ablation across six public IDS benchmark datasets spanning enterprise network traffic (UNSW-NB15, CICIDS2017), IoT environments (ToN-IoT, N-BaIoT, Edge-IIoTset), and industrial control systems (HAI), comprising 24 centralized experiments with multi-seed statistical validation for UNSW-NB15 multiclass and binary classification for all six datasets. In single-seed multiclass experiments, MAFT improves accuracy by + 1.7 to + 22.9 percentage points on four heterogeneous datasets, reduces false alarm rates by up to 12 ×, and improves F1 scores for 8 of 15 classes that achieved 0% F1 under the plain baseline. Multi-seed multiclass validation was performed for UNSW-NB15; the all-dataset multi-seed extension is binary classification and should be interpreted as seed-stability evidence rather than direct multiclass replication. Two datasets with homogeneous, well-conditioned features show negligible change, an observed boundary condition that correlates with feature heterogeneity and helps practitioners assess applicability before full model training. Comparison against eight alternative preprocessing methods shows MAFT’s competitive accuracy alongside consistent cross-dataset applicability without dataset-specific tuning. The results position semantic feature conditioning as an under-examined IDS design choice that can improve gradient-based classifiers without changing downstream model architecture, while also identifying cases where simpler or dataset-adaptive preprocessing is sufficient.

The authors' abstract, as published at the source. Discover Artificial Intelligence, 2026 · DOI ↗