External Sinkhole Attack Detection in Large-Scale WSNs Using Metaheuristic Feature Selection

Seungwoo Han; Sawako Kitagata; Ingon Chanpornpakdi; Toshihisa Tanaka; Su Man Nam

cs.CRAug 15, 2026

External Sinkhole Attack Detection in Large-Scale WSNs Using Metaheuristic Feature Selection

Authors: Seungwoo Han, Sawako Kitagata, Ingon Chanpornpakdi, Toshihisa Tanaka, Su Man Nam

Organizations: Department of Electrical Engineering and Computer Science, Tokyo University of Agriculture and Technology, Tokyo, Japan · Department of Digital Security, Cheongju University, Cheongju-si, Republic of Korea

Abstract

Sinkhole attacks in large-scale wireless sensor networks (WSNs) pose a serious threat to network functionality. This paper presents a metaheuristic feature selection for sinkhole attack detection using the bee swarm optimization (BSO) algorithm. In an external sinkhole attack simulation with 2000 nodes deployed over a 3000 $\times$ 3000 m $^2$ field, the proposed method achieves a detection accuracy of 0.997 while reducing the 16-feature set to eight features.

Figures & tables

Feature list from PyWSNSim [ 2 ]
0. pos_x	1. pos_y	2. hop_count	3. neighbor_nodes
4. route_changes	5. distance_to_bs	6. tx_count	7. rx_count
8. energy_level	9. initial_energy	10. energy_percentage	11. consumed_energy_tx
12. consumed_energy_rx	13. total_consumed_energy	14. tx_energy_per_byte	15. rx_energy_per_byte

TABLE I: Feature List from PyWSNSim-Based Sinkhole Attack Simulation.

Method	$\bm{N_{f}}$	Acc.	Pre.	Rec.	FLOPs/sample
All features (Baseline)	16	0.995	1.000	0.800	1952
Low-variance threshold	13	0.995	1.000	0.800	1586
LASSO	8	0.992	0.888	0.800	1040
BSO (Proposed)	8	0.997	1.000	0.900	912

TABLE II: Performance comparison of different feature selection methods.

Author	Inference model	Attack type	Field size	Node count	$\bm{N_{f}}$	Acc.	Pre.	Rec.	FLOPs/sample
Ioannou et al. [ 4 ]	Logistic regression	Inside	5 $\times$ 5	25	4	1.000	1.000	1.000	N.R.
Aissaoui et al. [ 5 ]	SVM	Inside	100 $\times$ 100	20	2	1.000	N.R.	N.R.	N.R.
Hasan et al. [ 6 ]	Random forest	Inside	500 $\times$ 500	50	5	1.000	1.000	1.000	N.R.
Bensaid et al. [ 7 ]	Neural networks	Inside	1000 $\times$ 1000	45	8	0.971	N.R.	N.R.	N.R.
Khedr et al. [ 8 ]	Neural networks	Inside	1100 $\times$ 1100	500	4	0.954	0.972	0.978	N.R.
Han et al. [ 2 ]	SVM	Outside	2000 $\times$ 2000	1000	16	0.980	1.000	0.764	N.R.

TABLE III: Comparison of experiment scale and detection performance with existing studies. Values denote figures reported in the referenced studies.

Network Intrusion Detection

Network intrusion detection identifies malicious or abnormal network activity to help protect computers, connected devices, and critical infrastructure.

See all 168 papers

BARS: Benign-Anchored Ranking and Selection for False Alarm Reduction in Network Intrusion Detection
Jul 14, 2026Abu Fuad Ahmad, Istiaque AhmedNetwork Intrusion Detection Feature Selection
Department of Computer Science New Mexico State University Las Cruces, New Mexico, USA · Graduate School of Informatics Osaka Metropolitan University Osaka, Japan
Explainable Hybrid Feature Selection for Intrusion Detection in Internet of Medical Things Environments
Aug 1, 2026Amira Berrezzek, Hayet Djellali, Giulio Mallardi +1IoT Intrusion Detection Network Intrusion Detection
Computer Science Dept. Badji Mokhtar University Annaba, Algeria · Computer Science Dept. University of Bari Bari, Italy
nCMD: Benign-Anchored Feature Selection for Imbalanced Network Intrusion Detection
Jun 7, 2026Abu Fuad Ahmad, Istiaque AhmedClass-Imbalanced Learning Network Intrusion Detection
Department of Computer Science · New Mexico State University · Las Cruces, New Mexico, USA +3

Jul 14, 2026J/K move · Enter open · S save

BARS: Benign-Anchored Ranking and Selection for False Alarm Reduction in Network Intrusion Detection

Abu Fuad Ahmad, Istiaque Ahmed

Department of Computer Science New Mexico State University Las Cruces, New Mexico, USA · Graduate School of Informatics Osaka Metropolitan University Osaka, Japan

Network Intrusion Detection Feature Selection

Open paper AskPDF arXiv

False alarms remain a major barrier to deploying network intrusion detection systems (NIDS). In high-volume environments, even a sub-1% false positive rate can generate tens of thousands of daily alerts. Filter-based feature selection is attractive because it operates upstream of the classifier and adds no inference-time cost. However, classical filters use class-symmetric criteria that ignore the asymmetry of intrusion detection, where benign traffic defines the baseline and attacks are deviations from it. A recent class-asymmetric filter, Classwise Mean Deviation (CMD), addresses this issue but anchors its score to a global mean that shifts toward attack distributions under class imbalance, weakening the deviations it aims to capture. We propose Benign-Anchored Ranking and Selection (BARS), a two-stage filter that replaces CMD's global anchor with the benign-class mean and applies an order-preserving decorrelation step. We evaluate BARS on CICIDS2017, CICDDoS2019, and UNSW-NB15 using feature budgets k = {5, 10, 20, 30, 40}. On attack-majority datasets, where global-anchor bias is strongest, BARS reduces false positive rate relative to CMD by 15.4% on UNSW-NB15 at k = 20 and by 21% to 23% on CICDDoS2019 at small feature budgets while preserving true positive rate and macro-F1. On benign-majority data, BARS and CMD converge, consistent with the theoretical limit where global- and benign-anchored scores coincide. BARS is a principled refinement of CMD rather than a universally dominant filter. Although Pearson Correlation and Mutual Information often achieve lower false positive rates, they exceeded 1 TB of memory on the largest benchmarks in our evaluation. BARS retains linear-time scoring and a low memory footprint, making it suitable for resource-constrained deployments.

Abstract

Network Intrusion Detection

Explore similar work

BARS: Benign-Anchored Ranking and Selection for False Alarm Reduction in Network Intrusion Detection

Explainable Hybrid Feature Selection for Intrusion Detection in Internet of Medical Things Environments

nCMD: Benign-Anchored Feature Selection for Imbalanced Network Intrusion Detection