Abstract
Feature selection is widely used in machine-learning-based intrusion detection systems (IDSs/NIDSs) to reduce dimensionality and computational burden, yet its benefits are difficult to attribute when feature evaluation, subset search, preprocessing, classifier design, and deployment conditions are assessed together. This systematic review analyzed 104 IDS/NIDS studies published from 2010 to 2026, identified through Scopus and Web of Science and supplemented by targeted Google Scholar searches. The corpus comprised 56 filter/relevance, 18 greedy/sequential, 28 hybrid/metaheuristic contrast, and 2 Other/Unclear studies. We assessed feature reduction, computational reporting, repeated-run evidence, feature-subset stability, leakage control, online cost, and deployment evidence. Among 42 studies with a single unambiguous reduction value, the median feature reduction was 73.8% (IQR: 59.3–84.2%). The runtime or computational cost was reported in 56.7% of studies and independent repeated runs in 9.6%, and no study explicitly evaluated feature-subset stability. Leakage-safe processing was clearly demonstrated in 13.5%, whereas 56.7% presented potential leakage risk; clear or partial deployment evidence was available in 6.7%. Out of six strict same-study comparisons, broader hybrid/metaheuristic methods improved reported detection performance in five, but gains in feature reduction and computational cost were inconsistent. Based on these findings, the review formulates feature-selection choice as a resource-constrained decision problem and proposes an algorithmic conditional-escalation workflow in which a broader search is introduced only when simpler strategies fail to satisfy predefined predictive or operational constraints. Additional search complexity should therefore be justified by comparable, reproducible, leakage-safe, and deployment-relevant evidence rather than by cross-study accuracy alone.