NTFR: A Network Traffic Feature Reduction Method Based on Relational Analysis

Network traffic features are the key indicators that reflect the nature, behavior, and patterns of network traffic. They serve as the foundation for solving traffic analysis problems using machine learning, directly impacting the performance of models. However, more features are not always better. Using irrelevant or redundant features does not contribute new information to model training. Instead, it increases the cost of data storage and the computational resources required by the model. Moreover, it may weaken the role of some important features, increase the risk of overfitting, and lead to issues such as the “curse of dimensionality.” Currently, research on feature redundancy in traffic analysis mainly includes feature selection and feature dimensionality reduction. However, due to their mathematical and statistical nature, these methods treat features as simple numerical information, which obscures the semantic information of the features and ignores the inherent relationships between them. Therefore, the optimal feature subset obtained is often the best mathematical combination but may not correspond to meaningful features related to the original data, causing a loss of the domainspecific uniqueness of traffic features and leading to results that lack intuitive interpretability. This paper proposes a network traffic feature reduction method, NTFR (Network Traffic Feature Reduction), based on relational analysis, starting from the domain uniqueness of network traffic features. NTFR focuses on the relationships between traffic features and reduces the feature set extracted by traffic analysis algorithms to obtain a reduced feature set. This reduced set maximizes the ability to preserve the original feature set's capacity to capture the differences in traffic while ensuring that the features are mutually independent. Experimental results on several common basic machine learning models demonstrate that the reduced feature set obtained using NTFR can achieve classification accuracy similar to or slightly better than the original feature set, even with a significantly smaller number of features. At the same time, traffic perturbation based on the reduced feature set can cause most of the features in the original feature set to change, significantly reducing the model's classification accuracy.