Feature selection plays a critical role in enhancing the performance, interpretability, and efficiency of intrusion detection systems (IDS). In this study, we conduct a comprehensive comparative investigation of two reinforcement learning–based feature selection methods: Proximal Policy Optimization (PPO) and Grouped Relative Policy Optimization (GRPO). Using the KDD99 benchmark dataset, we evaluate both algorithms under varying maximum feature selection constraints to assess their effectiveness, robustness, and computational efficiency. Our experimental results show that PPO exhibits more stable and balanced performance when the number of selected features is strictly limited, making it suitable for scenarios requiring strong sparsity or lightweight deployment. In contrast, GRPO demonstrates superior performance, particularly in terms of the Area Under the Curve (AUC), when feature constraints are relaxed or removed. GRPO also produces more balanced policy distributions during training, enabling improved exploration of feature interactions. However, the group-based computation mechanism of GRPO introduces higher computational overhead compared to PPO. Overall, this comparative study reveals clear trade-offs between performance and efficiency, offering practical guidance for selecting appropriate reinforcement learning–based feature selection algorithms in intrusion detection applications.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Comparative Study on Feature Selection for Intrusion Detection Based on PPO and GRPO Algorithms

  • Bo Wang,
  • Mei Feng,
  • Yawei Liu,
  • Chen Gao,
  • Jun Peng,
  • Fan Zhang,
  • Ning Miao,
  • Zhengcen Teng

摘要

Feature selection plays a critical role in enhancing the performance, interpretability, and efficiency of intrusion detection systems (IDS). In this study, we conduct a comprehensive comparative investigation of two reinforcement learning–based feature selection methods: Proximal Policy Optimization (PPO) and Grouped Relative Policy Optimization (GRPO). Using the KDD99 benchmark dataset, we evaluate both algorithms under varying maximum feature selection constraints to assess their effectiveness, robustness, and computational efficiency. Our experimental results show that PPO exhibits more stable and balanced performance when the number of selected features is strictly limited, making it suitable for scenarios requiring strong sparsity or lightweight deployment. In contrast, GRPO demonstrates superior performance, particularly in terms of the Area Under the Curve (AUC), when feature constraints are relaxed or removed. GRPO also produces more balanced policy distributions during training, enabling improved exploration of feature interactions. However, the group-based computation mechanism of GRPO introduces higher computational overhead compared to PPO. Overall, this comparative study reveals clear trade-offs between performance and efficiency, offering practical guidance for selecting appropriate reinforcement learning–based feature selection algorithms in intrusion detection applications.