Hussein Fawaz, Fatima Ezzeddine, Silvia Giordano, Omran Ayoub
SUPSI, Switzerland
IEEE International Conference on Wireless and Mobile Computing, Networking and Communications (WiMob), 2025
The problem
Intrusion detection systems rely on probabilistic outputs to prioritize alerts, so the confidence of their predictions matters as much as their accuracy. Poorly calibrated models lead to overconfident false positives or missed attacks — both critical in operational environments.
What we propose
A feature selection framework that combines SHAP values for explainability with calibration metrics (ECE, Brier score) for reliability. Features are selected not only for accuracy, but also for their contribution to well-calibrated predictions.
Results and takeaways
Across multiple intrusion detection datasets, our approach significantly improves calibration while maintaining or improving detection performance, producing more trustworthy confidence estimates. Reliable confidence estimates allow security operators to make better-informed decisions, reducing alert fatigue and operational risk. We are extending this work with uncertainty quantification and conformal prediction to provide formal reliability guarantees.
