A cluster-preserving feature selection framework cut intrusion detection features from 78 to 27 on the CICIDS2017 benchmark while Random Forest and XGBoost maintained roughly 99.9 percent accuracy.