IAES
Inter
national
J
our
nal
of
Articial
Intelligence
(IJ-AI)
V
ol.
15,
No.
5,
October
2026,
pp.
4026
∼
4038
ISSN:
2252-8938,
DOI:
10.11591/ijai.v15.i5.pp4026-4038
❒
4026
LLM-FS-Agent:
a
deliberati
v
e
r
ole-based
lar
ge
language
model
ar
chitectur
e
f
or
transpar
ent
featur
e
selection
Mohamed
Bal-Ghaoui
1
,
F
ayssal
Sabri
2
1
Lab’Inno
v
,
Department
of
Research
and
De
v
elopment,
Audensiel
Conseil,
P
aris,
France
2
´
Ecole
Centrale
de
L
yon,
L
yon,
France
Article
Inf
o
Article
history:
Recei
v
ed
Oct
21,
2025
Re
vised
Jul
27,
2026
Accepted
Aug
12,
2026
K
eyw
ords:
Dimensionality
reduction
Feature
selection
Intrusion
detection
system
Lar
ge
language
models
Machine
learning
ABSTRA
CT
High-dimensional
data
can
reduce
interpretability
and
incre
ase
computational
cost
in
machine
learning
(ML)
pipelines.
Lar
ge
language
models
(LLMs)
of
fer
a
promising
approach
for
dimensionality
reduction
through
feature
selection
(FS),
b
ut
e
xisting
LLM-based
methods
lack
structured
reasoning
and
do
not
pro
vide
clear
justications
for
their
choices.
This
study
propose
LLM-FS-Agent,
a
multi-agent
architecture
where
specialized
LLM
roles
collaborate
through
a
deliberati
v
e
process
to
e
v
aluate
and
rank
feature
s.
Each
selection
decision
is
accompanied
by
an
e
xpl
icit
rationale.
W
e
tested
our
method
on
the
CIC-DIAD
2024
internet
of
things
(IoT)
intrusion
detection
dataset
and
compared
it
ag
ainst
LLM-select
and
traditional
techniques
lik
e
principal
component
analysis
(PCA)
across
multiple
subset
sizes.
LLM-FS-Agent
achie
v
es
comparable
or
better
accurac
y
while
reducing
classier
training
time
by
46%
on
a
v
erage
(statistically
signicant,
0.094
s,
p
=
0.028
for
e
xtreme
gradient
boos
ting
(XGBoost)).
These
results
sho
w
that
multi-agent
deliberation
impro
v
es
transparenc
y
and
computational
ef
cienc
y
in
FS.
This
is
an
open
access
article
under
the
CC
BY
-SA
license
.
Corresponding
A
uthor:
Mohamed
Bal-Ghaoui
Lab’Inno
v
,
Department
of
Research
and
De
v
elopment,
Audensiel
Conseil
P
aris,
France
Email:
m.bal-ghaoui@audensiel.com
1.
INTR
ODUCTION
Machine
learning
(ML)
pipelines
are
central
to
man
y
scientic
and
industrial
applications.
Ho
we
v
er
,
their
performance
is
ofte
n
limited
by
curse
of
dimensionality
[1].
As
the
number
of
features
gro
ws,
computational
costs
increase,
o
v
ertting
becomes
more
lik
ely
,
and
generalization
de
grades
[2].
Addressing
this
issue
is
important
for
reliable
ML
deplo
yment.
Feature
selection
(FS)
aims
to
nd
a
small
set
of
informati
v
e
features
while
k
eeping
their
original
meaning.
T
raditional
FS
methods
are
grouped
into
lter
,
wrapper
,
and
embedded
approaches
[3]–[5].
Filter
methods
rank
features
using
statistical
criteria
without
in
v
olving
a
learning
model
[6].
Wrapper
methods
search
for
feature
subsets
that
maximize
predicti
v
e
performance
[7].
Embedded
methods
inte
grate
FS
into
model
training
through
re
gularization
[8],
[9].
These
methods
w
ork
well
b
ut
often
beha
v
e
as
black
box
es.
The
y
pro
vide
little
e
xplanation
for
wh
y
specic
features
are
selected
or
discarded.
This
lack
of
transparenc
y
is
especially
problematic
in
c
ybersecurity
,
where
analysts
need
to
understand
and
trust
the
decisions
made
by
ML
systems.
Lar
ge
language
models
(LLMs)
ha
v
e
created
ne
w
opportunities
for
FS.
Li
et
al.
[10]
classify
LLM-based
FS
into
te
xt-based
and
data-dri
v
en
approaches.
T
e
xt-based
FS
uses
onl
y
feature
names
and
task
descriptions,
relying
on
the
LLMs
pre-t
rained
kno
wledge
without
needing
numerical
data.
This
J
ournal
homepage:
http://ijai.iaescor
e
.com
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Artif
Intell
ISSN:
2252-8938
❒
4027
w
orks
well
when
data
is
scarce
and
impro
v
es
with
lar
ger
models.
The
LLM-select
frame
w
ork
[11]
proposes
se
v
eral
prompting
strate
gies
(LLM-score,
LLM-rank,
LLM-SEQ)
and
sho
ws
that
LLMs
can
match
classical
FS
methods
e
v
en
without
training
data.
Ho
we
v
er
,
perform
ance
depends
hea
vily
on
model
size.
Retrie
v
al-augmented
feature
selection
(RAFS)
[10]
adds
e
xternal
domain
kno
wledge
to
impro
v
e
results
in
specialized
elds
lik
e
medicine.
Data-dri
v
en
FS
gi
v
es
LLMs
actual
feature
v
alues
or
sample
data
so
the
y
can
perform
statistical
reasoning
[10].
This
w
orks
in
limited
settings
b
ut
is
constrained
by
LLM
conte
xt
windo
ws.
As
sample
size
gro
ws,
performance
de
grades
[12],
[13].
Data-dri
v
en
methods
often
underperform
te
xt-based
approaches
in
both
lo
w-resource
and
full-shot
s
ettings.
LLMs
ha
v
e
also
been
used
for
feature
engineering.
Han
et
al.
[14]
used
LLMs
to
generate
meta-features,
and
Y
ang
et
al.
[15]
proposed
in-conte
xt
e
v
olutionary
search
(ICE-SEARCH),
which
renes
feature
subsets
based
on
test
performance.
The
limits
of
single-agent
prompting
ha
v
e
led
to
multi-agent
LLM
architectures
that
handle
comple
x
tasks
through
modular
reasoning
and
coordination
[16],
[17].
These
s
y
s
tems
connect
LLMs
to
e
xternal
tools
and
application
programming
interf
aces
(APIs)
for
structured
problem
solving
[18],
[19].
Applications
in
data
science
sho
w
promise
for
automated
analysis
[20],
[21].
Frame
w
orks
lik
e
tree-of-thought
(T
oT)
[22],
graph-of-thought
(GoT)
[23],
and
mixture-of-agents
(MoA)
[24]
sho
w
that
coordinated
multi-agent
reasoning
can
outperform
single
models.
These
methods
impro
v
e
reliabili
ty
and
interpretability
through
structured
deliberation.
Ho
we
v
er
,
e
xisting
multi-agent
frame
w
orks
are
designed
for
general
reasoning
and
lack
the
specic
mechanisms
needed
for
FS.
The
y
do
not
address
issues
lik
e
feature
redundanc
y
,
collinearity
,
or
rob
ustness
ag
ainst
adv
ersarial
manipulation,
which
are
critical
in
c
ybersecurity
.
2.
METHOD
2.1.
Experimental
setup
and
data
pr
epr
ocessing
All
e
xperiments
were
conducted
using
the
CIC-DIAD
2024
dataset
[25],
which
w
as
de
v
eloped
for
internet
of
things
(IoT)
intrusion
detection
and
comprises
84
features.
Thi
s
study
considered
three
classes
namely
benign,
brute
force,
and
mirai.
The
preprocessing
pipeline
in
v
olv
ed
data
cleaning,
the
remo
v
al
of
highly
correlated
features
[3]
based
on
a
Pearson
correlation
threshold
greater
than
0.9,
and
feature
standardization
using
StandardScaler
.
T
o
address
the
class
imbalance
issue,
random
undersampling
w
as
applied,
resulting
in
a
balanced
dataset.
T
able
1
presents
the
class
distrib
ution
before
and
after
the
preprocessing
steps.
T
able
1.
Dataset
distrib
ution
before
and
after
preprocessing
Class/Dataset
Original
Preprocessed
Benign
183
595
(94.0%)
3
619
(29.2%)
Mirai
5
170
(2.6%)
5
170
(41.7%)
Brute
F
orce
3
619
(1.9%)
3
619
(29.2%)
T
otal
192,384
(100%)
12,408
(100%)
2.2.
Ev
aluation
pr
otocol
Figure
1
sho
ws
the
e
v
aluation
w
orko
w
adopted
in
this
study
.
F
our
classical
ML
classiers
were
selected
namely
random
forest
(RF),
e
xtreme
gradient
boosting
(XGBoost),
support
v
ector
classier
(SVC),
and
logistic
re
gression
(LR).
These
models
represent
dif
ferent
learning
paradigms,
including
ensemble
learning,
gradient
boosting,
k
ernel-based
classication,
and
linear
modeling
[2].
Model
performance
w
as
e
v
aluated
using
accurac
y
and
the
area
under
the
curv
e
(A
UC)
recei
v
er
operating
characteristic
(R
OC).
All
LLMs
were
e
x
ecuted
locally
using
the
Ollama
frame
w
ork,
including
Llama
3.2
(2
B),
Gemma
3
(4B),
Qwen
(4B),
Phi-3
Mini
(3B),
and
Mi
stral
(4B).
Based
on
the
generated
feature
importance
rankings,
feature
subsets
of
dif
ferent
sizes
were
e
v
aluated,
with
n
∈
5
,
10
,
20
,
30
,
40
,
and
50
.
These
e
xperiments
were
designed
to
in
v
estig
ate
t
he
impact
of
feature
subset
size,
FS
method,
LLM
conguration,
and
classier
choice
on
the
o
v
erall
performance.
Additional
e
xperiments
were
conducted
using
smaller
models,
including
Gemma3-1B,
Qwen3-0.6B,
LLaMA-3.2-1B,
and
Phi-3-Mini,
to
further
analyze
the
inuence
of
model
capacity
and
rol
e
assignment
within
the
proposed
frame
w
ork.
F
or
each
e
xperiment,
a
rank
ed
feature
list
w
as
generated.
The
rener
role
uses
statistical
guidance
by
analyzing
feature-le
v
el
metadata,
including
feature
mean,
standard
de
viation,
and
correlation
with
the
tar
get
v
ariable.
This
information
pro
vides
additional
e
vidence
for
rening
the
initial
feature
importance
scores
produced
by
the
initiator
role,
enabling
a
more
informed
feature
ranking
process.
LLM-FS-Ag
ent:
a
deliber
ative
r
ole-based
lar
g
e
langua
g
e
model
ar
c
hitectur
e
for
...
(Mohamed
Bal-Ghaoui)
Evaluation Warning : The document was created with Spire.PDF for Python.
4028
❒
ISSN:
2252-8938
DA
T
A
PRE-PROCESSING
EV
ALUA
TION PROT
OCOL
Classes
Benign, BruteForce, Mirai
CIC-DIAD 2024 Dataset
Data Cleaning & Collinearity
Removal (Pearson > 0.9)
StandardScaler (Mean=0, Std=1)
Balanced Classes
LLM-FS-Agent
Initiator
Challenger
Judge
Refiner
Metadata
LLama 3
(2b)
Qwen
(4b)
Phi 3 mini
(2b)
Gemma 3
(4b)
LLM-SELECT
(Single-Agent Basline)
Generate
6 feature subsets
(n=5, 10, 20, 30, 40, 50)
Classifier
T
raining & Evaluation
RF
, XGBoost, SVC, LR
Metrics:
T
raining & Evaluation
Comparative
Analysis
Best
Architecture-LLM Pairing
Prepared Dataset
Mistral
(4b)
Figure
1.
Pipeline
and
e
v
aluation
protocol
of
LLM-FS-Agent
2.3.
LLM-FS-Agent
ar
chitectur
e
design
and
the
deliberati
v
e
featur
e
selection
pr
ocess
The
proposed
LLM-FS-Agent
is
a
transparent
multi-agent
FS
frame
w
ork
[16],
[17]
that
emplo
ys
a
structured
deliberation
mechanism
[22]–[24].
As
illustrated
in
Figure
2,
the
frame
w
ork
recei
v
es
feature
names
and
a
task
description
as
inputs
[10].
Each
role-specic
agent
generates
a
set
of
ar
guments
that
either
justify
or
question
the
rele
v
ance
of
indi
vidual
features,
as
summarized
in
T
able
2.
T
o
f
acilitate
reproducibility
,
the
prompts
associated
with
each
agent
role
are
pro
vided
in
Figures
3
to
6.
These
prompts
specify
the
instructions,
conte
xtual
information,
and
e
xpected
outputs
for
each
stage
of
the
deliberati
v
e
FS
process.
Figure
2.
Architecture
of
the
LLM-FS-Agent
Int
J
Artif
Intell,
V
ol.
15,
No.
5,
October
2026:
4026–4038
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Artif
Intell
ISSN:
2252-8938
❒
4029
T
able
2.
Roles
and
responsibilities
of
agents
in
the
LLM-FS-Agent
frame
w
ork
Agent
role
Description
Initiator
Does
an
initial
semanti
c
analysis
of
each
feature
based
on
the
task
description
and
pro
vides
a
rst
rele
v
ance
score.
Rener
Impro
v
es
the
Initiator’
s
analysis
by
adding
supporting
ar
guments
and
statistical
metadata,
such
as
mean,
standard
de
viation,
and
feature-tar
get
correlation.
Challenger
Re
vie
ws
the
Initiator’
s
ar
guments
critically
to
nd
weaknesses,
redundancies,
or
biases,
and
pro
vides
counter
-ar
guments
in
a
peer
-re
vie
w
style.
Judge
Acts
as
the
nal
decision
mak
er
by
combining
all
ar
guments.
It
computes
a
nal
importance
score
(
S
nal
)
for
each
feature
as
a
weighted
sum
of
the
rened
(
S
rened
)
and
challenged
(
S
challenged
)
scores:
S
nal
=
w
r
S
rened
+
w
c
S
challenged
,
w
r
+
w
c
=
1
Figure
3.
The
initiator
LLM
prompt
template
Figure
4.
The
rener
LLM
prompt
template
Figure
5.
The
challenger
LLM
prompt
template
LLM-FS-Ag
ent:
a
deliber
ative
r
ole-based
lar
g
e
langua
g
e
model
ar
c
hitectur
e
for
...
(Mohamed
Bal-Ghaoui)
Evaluation Warning : The document was created with Spire.PDF for Python.
4030
❒
ISSN:
2252-8938
Figure
6.
The
judge
LLM
prompt
template
3.
RESUL
TS
AND
DISCUSSION
3.1.
Quantitati
v
e
perf
ormance
and
generalizability
The
performance
of
LLM-FS-Agent
w
as
compared
with
LLM-select
[11]
and
principal
component
analysis
(PCA)
[3]
using
do
wnstream
classiers,
including
XGBoost
(Figure
7),
RF
(Figure
8),
SVC
(Figure
9),
and
LR
(Figure
10),
across
dif
ferent
feature
s
ubset
sizes
(
n
=
5
,
10
,
20
,
30
,
40
,
and
50
).
As
illustrated
in
Figures
7
and
8,
XGBoost
and
RF
consistently
achie
v
e
high
accurac
y
across
v
arying
subset
sizes,
demonstrating
the
rob
ustness
of
the
selected
feature
representations.
T
able
3
summarizes
the
mean
A
UC
and
accurac
y
v
alues
obtained
at
the
best-performing
subset
size
(
n
=
20
).
Under
this
conguration,
LLM-FS-Agent
reduces
performance
v
ariability
compared
with
single-agent
FS
approaches
and
impro
v
es
accurac
y
by
up
to
+1
.
49%
in
cases
where
LLM-select
performs
less
ef
fecti
v
ely
,
while
introducing
only
mar
ginal
decreases
for
the
remaining
models.
Figure
11
pro
vides
a
comprehensi
v
e
comparison
across
the
six
e
v
aluated
feature
subset
sizes
,
where
Figures
11(a)
to
11(f)
report
accurac
y
results
and
Figures
11(g)
to
11(l)
pres
ent
A
UC
measurements.
Re
g
arding
accurac
y
,
LLM-select
achie
v
es
competiti
v
e
resul
ts
under
the
most
constrained
feature
size
(
n
=
5
),
whereas
LLM-FS-Agent
sho
ws
increasing
adv
antages
as
the
subset
size
gro
ws,
reaching
its
best
performance
at
n
=
20
.
Although
LLM-select
remains
comparable
at
n
=
40
,
it
e
xhibits
lar
ger
performance
uctuations,
whereas
LLM-FS-Agent
maintains
stable
results
across
lar
ger
feature
subsets.
A
similar
trend
is
observ
ed
for
A
UC,
while
all
approaches
pro
vide
strong
discriminati
v
e
capability
with
only
v
e
selected
features,
LLM-FS-Agent
deli
v
ers
more
consistent
performance
across
n
=
10
–
50
,
with
n
=
20
pro
viding
the
most
stable
results
across
dif
ferent
classiers
and
LLM
backbones.
Ov
erall,
LLM-FS
-Agent
achie
v
es
superior
performance
for
intermediate
and
lar
ger
subsets
(
n
=
10
,
20
,
30
,
and
50
),
while
LLM-Select
remains
competiti
v
e
mainly
at
n
=
5
and
occasionally
at
n
=
40
.
These
ndings
suggest
that
the
multi-agent
frame
w
ork
enables
more
reliable
feature
ranking
across
dif
ferent
feature
b
udgets.
Int
J
Artif
Intell,
V
ol.
15,
No.
5,
October
2026:
4026–4038
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Artif
Intell
ISSN:
2252-8938
❒
4031
Figure
7.
Performance
curv
e
of
the
XGBoost
classier
Figure
8.
Performance
curv
e
of
the
RF
classier
LLM-FS-Ag
ent:
a
deliber
ative
r
ole-based
lar
g
e
langua
g
e
model
ar
c
hitectur
e
for
...
(Mohamed
Bal-Ghaoui)
Evaluation Warning : The document was created with Spire.PDF for Python.
4032
❒
ISSN:
2252-8938
Figure
9.
Performance
curv
e
of
the
SVC
Figure
10.
Performance
curv
e
of
the
LR
classier
Int
J
Artif
Intell,
V
ol.
15,
No.
5,
October
2026:
4026–4038
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Artif
Intell
ISSN:
2252-8938
❒
4033
Accuracy
(a)
(b)
(c)
(d)
(e)
(f)
A
UC
(g)
(h)
(i)
(j)
(k)
(l)
Figure
11.
Comparison
of
accurac
y
and
A
UC
across
feature
subset
sizes:
(a)
accurac
y
at
n
=
5
,
(b)
accurac
y
at
n
=
10
,
(c)
accurac
y
at
n
=
20
,
(d)
accurac
y
at
n
=
30
,
(e)
accurac
y
at
n
=
40
,
(f)
accurac
y
at
n
=
50
;
(g)
A
UC
at
n
=
5
,
(h)
A
UC
at
n
=
10
,
(i)
A
UC
at
n
=
20
,
(j)
A
UC
at
n
=
30
,
(k)
A
UC
at
n
=
40
,
and
(l)
A
UC
at
n
=
50
LLM-FS-Ag
ent:
a
deliber
ative
r
ole-based
lar
g
e
langua
g
e
model
ar
c
hitectur
e
for
...
(Mohamed
Bal-Ghaoui)
Evaluation Warning : The document was created with Spire.PDF for Python.
4034
❒
ISSN:
2252-8938
T
able
3.
Performance
comparison
of
best
models
on
LLM-Select
vs.
LLM-FS-Agent
(a
v
erage
across
subsets)
LLM
A
UC
∆
%
Accurac
y
∆
%
LLM-select
LLM-F
S-Agent
LLM-select
LLM-FS-Agent
XGB
RF
XGB
RF
XGB
RF
XGB
RF
Mistral
0.976
0.964
0.965
0.947
-0.99
0.892
0.876
0.870
0.854
-2.25
Qwen
0.975
0.963
0.980
0.974
+0.46
0.890
0.872
0.902
0.897
+1.21
Gemma3-4B
0.973
0.968
0.978
0.973
+0.50
0.888
0.884
0.903
0.894
+1.49
LLaMA3-2B
0.973
0.962
0.974
0.964
+0.15
0.880
0.864
0.885
0.879
+0.45
Phi3-mini
0.979
0.969
0.972
0.962
-0.64
0.902
0.886
0.882
0.862
-1.97
A
v
erage
0.975
0.965
0.974
0.964
+0.10
0.890
0.876
0.888
0.877
+0.19
3.2.
Computational
efciency
and
qualitati
v
e
e
v
aluation
of
featur
e
r
easoning
Analysis
of
T
ables
4
and
5
sho
ws
that
LLM-FS-Agent
reduces
do
wnstream
classier
training
time.
F
or
XGBoost,
the
a
v
erage
speedup
is
1
.
87
×
with
statistical
signicance
(
p
=
0
.
028
,
Cohen’
s
d
=
0
.
87
).
Inference
times
impro
v
ed
slightly
.
The
g
ains
in
A
UC
and
accurac
y
,
while
modest,
support
the
multi-agent
frame
w
ork
and
of
fset
the
deliberation
o
v
erhead.
T
able
4.
Computational
ef
cienc
y
comparison
(XGBoost)
LLM
backbone
T
raining
time
(s)
Inference
time
(s)
Speedup
LLM-select
LLM-FS-Agent
LLM-select
LLM-FS-Agent
T
raining
Inference
Mistral
0.434
0.108
0.0023
0.0016
4.02
×
1.44
×
Qwen
0.117
0.108
0.0014
0.0015
1.08
×
0.93
×
Gemma3-4B
0.101
0.113
0.0015
0.0016
0.89
×
0.94
×
LLaMA3-2B
0.252
0.108
0.0018
0.0015
2.33
×
1.20
×
Phi3-mini
0.121
0.117
0.0016
0.0017
1.03
×
0.94
×
A
v
erage
0.205
0.111
0.0017
0.0016
1.87
×
1.09
×
T
able
5.
Statistical
signicance
analysis
(XGBoost)
Metric
Mean
Dif
f.
p-v
alue
Cohen’
s
d
Ef
fect
A
UC
+0.0010
0.342
0.28
Small
Accurac
y
+0.0017
0.456
0.19
Small
T
raining
time
-0.094s
0.028*
-0.87
Lar
ge
Inference
time
-0.0001s
0.234
-0.31
Small
*Statistically
signicant
at
α
=
0
.
05
Ef
fect
size:
|
d
|
<
0
.
2
(ne
gligible),
0.2-0.5
(small),
0.5-0.8
(medium),
>
0
.
8
(lar
ge)
3.3.
Statistical
guidance
and
lar
ge
language
model
r
ole
effects
on
featur
e
selection
The
impact
of
statistical
gui
dance
and
LLM
role
congurations
on
FS
w
as
e
v
aluated
through
do
wnstream
ML
performance,
including
confusion
matrices
and
o
v
erall
accurac
y
.
Using
LLM-FS-Agent
with
four
LLM
backbones,
all
71
features
were
analyzed
and
rank
ed
according
to
their
estimated
importance.
T
able
6
presents
the
feature
importance
scores
generated
by
each
LLM
role,
along
with
the
nal
aggre
g
ated
scores
produced
by
the
judge
agent
across
the
four
best-performing
e
xperiments.
T
emporal
and
pack
et-le
v
el
o
w
features,
such
as
pack
et
length
min/max,
Fwd
inter
-arri
v
al
time
(IA
T)
mean/max/Std,
and
idle
min,
consistently
appear
among
t
he
highest-rank
ed
features.
Their
frequent
selection
indicates
strong
discriminati
v
e
capability
for
distinguishing
benign
and
malicious
traf
c
patterns.
In
addition,
source
and
destination
port
st
atistics,
as
well
as
ag-count
features,
are
repeatedly
selected,
reecting
their
rele
v
ance
from
a
netw
ork
traf
c
analysis
perspecti
v
e
[25].
The
consistenc
y
among
dif
ferent
LLM
roles
and
the
stability
of
the
top-rank
ed
features
suggest
that
these
indicators
pro
vide
reliable
information
for
intrusion
detection.
T
able
7
summarizes
the
four
best-performing
ML
congurations.
XGBoost
achie
v
ed
the
strongest
o
v
erall
performance,
obtaining
accurac
y
v
alues
ranging
from
0.876
to
0.886,
F1-scores
between
0.873
and
0.884,
and
A
UC
v
alues
from
0.971
to
0.975,
while
maintaining
moderate
training
requirements
and
ef
cient
inference.
RF
achie
v
ed
slightly
lo
wer
performance,
with
accurac
y
ranging
from
0.866
to
0.881,
F1-scores
from
0.863
to
0.879,
and
A
UC
v
alues
between
0.962
and
0.971;
ho
we
v
er
,
it
pro
vided
f
aster
tra
ining,
making
it
a
practical
alternati
v
e
in
resource-constrained
scenarios.
In
contrast,
SVC
and
LR
e
xhibited
lo
wer
predi
cti
v
e
performance,
with
SVC
additionally
incurring
higher
training
and
inference
costs.
Among
the
LLM
role
congurations,
e
xperiment
1
achie
v
ed
the
best
do
wnstream
classication
results,
indicating
that
the
assignment
and
interaction
of
dif
ferent
agent
roles
can
signicantly
inuence
the
quality
of
generated
feature
rankings
and,
consequently
,
the
nal
model
performance.
Int
J
Artif
Intell,
V
ol.
15,
No.
5,
October
2026:
4026–4038
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Artif
Intell
ISSN:
2252-8938
❒
4035
T
able
6.
T
op-10
features
rank
ed
by
frame
w
ork
scores
Experiment
Feature
Initiator
Rener
Challenger
Judge
Judge
Reasoning
Experiment
1
P
ack
et
length
min
0.850
0.800
0.200
0.900
Analyzing
pack
et
length
patterns
helps
distinguish
benign
from
malicious
traf
c;
outliers
and
standard
de
viation
considered.
Fwd
IA
T
mean
0.850
1.000
0.800
0.900
Statistically
signicant
patterns
in
forw
ard
IA
T
are
k
e
y
for
threat
detection;
f
alse
positi
v
es
must
be
considered.
Src
port
0.900
0.800
0.800
0.800
Source
port
may
indicate
anomalies
when
correlated
with
other
indicators;
useful
for
initial
threat
assessment.
Fwd
IA
T
total
0.850
1.000
0.200
0.800
F
orw
ard
IA
T
T
otal
can
indicate
anomalous
traf
c;
should
not
be
used
in
isolation
for
prediction.
Subo
w
bwd
pack
ets
0.850
0.800
0.200
0.800
Subo
w
backw
ard
pack
ets
patterns
can
indicate
malicious
propag
ation;
statistical
signicance
prioritized.
Bwd
IA
T
mean
0.900
0.800
0.200
0.760
Useful
for
detecting
netw
ork
anomalies;
dynamic
threat
en
vironment
requires
cautious
interpretation.
Bwd
pack
ets/s
0.850
0.850
0.200
0.750
Pro
vides
netw
ork
performance
insight;
must
be
conte
xtualized
to
distinguish
benign
from
malicious
patterns.
FWD
init
win
bytes
0.850
0.850
0.200
0.740
F
orw
ard
initial
windo
w
bytes
can
predict
malicious
acti
vity;
statistical
e
vidence
prioritized.
Acti
v
e
max
0.850
0.900
0.300
0.720
High
acti
vity
le
v
els
indicate
potential
threats;
should
be
used
with
other
features
for
accurac
y
.
Flo
w
IA
T
std
0.850
0.850
0.200
0.720
Standard
de
viation
of
o
w
IA
T
can
signal
malicious
beha
vior;
conte
xt
with
other
indicators
is
critical.
Experiment
2
Acti
v
e
mean
0.65
0.85
0.50
0.85
Domain-focused
reasoning:
correlation
with
malicious
acti
vity
and
traf
c
patterns.
RST
ag
count
0.65
0.80
0.50
0.80
Pro
vides
clear
indication
of
potential
malicious
ac
ti
vity
,
critical
for
domain-focused
predictions.
Fwd
IA
T
std
0.65
0.80
0.50
0.80
Strong
statistical
signicance;
considered
for
predicting
malicious
beha
vior
.
Src
port
0.65
0.85
0.50
0.75
Conte
xtual
information
such
as
mean
and
std
supports
reliability
as
an
indicator
.
Flo
w
bytes/s
0.85
0.95
0.50
0.75
K
e
y
indicator
of
netw
ork
acti
vity;
essential
for
tasks
in
v
olving
data
mo
v
ement.
P
ack
et
length
mean
0.65
0.82
0.50
0.75
Important
for
detecting
malicious
acti
vity
,
b
ut
conte
xt-dependent.
Idle
min
0.65
0.85
0.70
0.75
Quantitati
v
e
strength
in
predicting
malicious
acti
vity;
secondary
importance
noted.
Protocol
0.85
0.92
0.60
0.72
Rele
v
ant
for
prediction
tasks;
other
features
may
pro
vide
redundanc
y
.
Flo
w
IA
T
max
0.65
0.80
0.70
0.70
Strong
correlation
with
malicious
acti
vity;
critical
for
predicti
v
e
tasks.
Subo
w
fwd
pack
ets
0.65
0.85
0.50
0.70
Prioritized
as
indicati
v
e
of
malicious
traf
c
in
netw
ork
analysis.
Experiment
3
P
ack
et
length
min
0.850
0.700
0.850
0.700
Helps
distinguish
normal
vs
malicious
traf
c;
outliers
and
standard
de
viation
important.
Flo
w
IA
T
max
0.850
0.790
0.700
0.700
Important,
b
ut
quantitati
v
e
analysis
suggests
limitations
due
to
normal
traf
c
patterns.
Idle
min
0.850
0.670
0.600
0.675
High
idle
times
indicate
potential
malicious
acti
vity;
domain
reasoning
prioritizes
this
feature.
P
ack
et
length
v
ariance
0.850
0.720
0.500
0.660
V
ariability
in
pack
et
lengths
may
indicate
anomalies;
less
predicti
v
e
alone.
Dst
Port
0.850
0.720
0.500
0.650
Captures
di
v
erse
usage;
not
primary
indicator
b
ut
useful
in
combination
with
other
features.
Acti
v
e
Std
0.900
0.750
0.500
0.625
Indicates
v
ariability
often
accompan
ying
malicious
acti
vity;
importance
conte
xt-dependent.
Subo
w
bwd
pack
ets
0.850
0.670
0.500
0.625
Rapid
propag
ation
patterns
indicati
v
e
of
malicious
traf
c;
more
rele
v
ant
in
lar
ge
netw
orks.
T
otal
bwd
pack
ets
0.850
0.670
0.600
0.625
Lo
w
v
ariance
reduces
standalone
im
portance;
domain-focused
reasoning
supports
use.
P
ack
et
length
max
0.850
0.620
0.700
0.625
Standard
de
viation
and
conte
xt
considered;
moderately
informati
v
e
predictor
.
FIN
ag
count
0.850
0.620
0.750
0.620
Quantitati
v
e
analysis
emphasizes
statistical
signicance;
useful
b
ut
less
critical.
Experiment
4
P
ack
et
length
max
0.800
0.760
0.600
0.720
Important
for
identifying
malicious
traf
c
considering
thresholds
and
conte
xt.
Fwd
se
g
size
min
0.750
0.730
0.600
0.690
Relati
v
ely
high
mean
size
dispersion;
indicati
v
e
of
malicious
traf
c
in
combination
with
other
features.
FWD
init
win
bytes
0.850
0.670
0.700
0.670
W
eak
correlation
with
tar
get;
conte
xtual
importance
slightly
more
rele
v
ant
than
ra
w
stats.
Bwd
IA
T
min
0.850
0.760
0.600
0.667
Lo
w
correlation
with
netw
ork
acti
vity;
unlik
ely
to
be
decisi
v
e
alone.
Fwd
IA
T
mean
0.850
0.670
0.600
0.667
Distrib
ution
patterns
considered;
correlation
with
other
features
moderately
informati
v
e.
P
ack
et
length
min
0.800
0.600
0.600
0.667
Useful
for
anomaly
detection;
simplicity
reduces
standalone
predicti
v
e
po
wer
.
Bwd
pack
et
length
max
0.800
0.650
0.600
0.650
Captures
suspicious
acti
vity
patterns;
statistical
metadata
moderately
informati
v
e.
Flo
w
pack
ets/s
0.750
0.670
0.700
0.625
Lo
w
correlation
alone;
conte
xtual
f
actors
increase
rele
v
ance.
Bwd
pack
et
length
min
0.850
0.650
0.600
0.625
Strong
semantic
rele
v
ance;
moderate
correlation
with
tar
get
v
ariable.
Idle
min
0.850
0.750
0.600
0.625
Some
predicti
v
e
po
wer;
may
be
noisy
,
b
ut
domain-focused
reasoning
supports
use.
LLM-FS-Ag
ent:
a
deliber
ative
r
ole-based
lar
g
e
langua
g
e
model
ar
c
hitectur
e
for
...
(Mohamed
Bal-Ghaoui)
Evaluation Warning : The document was created with Spire.PDF for Python.