Epsos Nids Eval

epsos-nids-eval

Extending Network Intrusion Detection with Enhanced Particle Swarm Optimization Techniques — Songma et al. (2024) (International Journal of Computer Networks & Communications (IJCNC) Vol.16, No.4, July 2024, 2024)

What this evaluates

Evaluates the ability of machine learning and deep learning classifiers, particularly Decision Trees optimized with Enhanced Particle Swarm Optimization, to accurately detect and classify multiple types of network intrusions in high-dimensional traffic data.

Datasets

• CSE-CIC-IDS-2018 — total 12017831; splits: train (-1), test (-1)
• LITNET-2020 — total 35196472; splits: train (-1), test (-1)

Metrics

• accuracy (primary) — range: [0, 1]
  • The proportion of correctly classified instances out of the total number of instances. Calculated as (True Positives + True Negatives) / Total Instances.
• precision — range: [0, 1]
  • The ratio of correctly predicted positive observations to the total predicted positives. Calculated as True Positives / (True Positives + False Positives).
• recall — range: [0, 1]
  • The ratio of correctly predicted positive observations to all observations in the actual class. Calculated as True Positives / (True Positives + False Negatives).
• f1-score — range: [0, 1]
  • The harmonic mean of precision and recall. Calculated as 2 * (precision * recall) / (precision + recall).

Input / output format

Input: Numerical feature vectors of length 69 (CSE-CIC-IDS-2018) or 42 (LITNET-2020), normalized via Min-Max scaling to [0, 1], with categorical attack labels encoded as integers.

Output: Multi-class classification label indicating the network traffic type (e.g., Benign, DDoS, DoS, Brute Force, Botnet, Infiltration, Web attacks for CSE-CIC-IDS-2018; none, Smurf, ICMP-flood, etc. for LITNET-2020).

Scoring recipe

def evaluate(y_true, y_pred):
    tp = sum(1 for t, p in zip(y_true, y_pred) if t == p)
    fp = sum(1 for t, p in zip(y_true, y_pred) if t != p)
    fn = sum(1 for t, p in zip(y_true, y_pred) if t != p)
    accuracy = tp / len(y_true)
    precision = tp / (tp + fp) if (tp + fp) > 0 else 0.0
    recall = tp / (tp + fn) if (tp + fn) > 0 else 0.0
    f1 = 2 * precision * recall / (precision + recall) if (precision + recall) > 0 else 0.0
    return {'accuracy': accuracy, 'precision': precision, 'recall': recall, 'f1-score': f1}

Common pitfalls

• Severe class imbalance where benign/none traffic accounts for 83-92% of the dataset, which can bias models toward the majority class if not addressed.
• Duplicate removal significantly alters class ratios and dataset composition, potentially affecting generalization if train/test splits are not created before deduplication.
• Min-Max normalization must be fit exclusively on training data to prevent data leakage and inflated performance metrics on the test set.

Evidence (verbatim from paper)

This study evaluates the performance of machine learning (ML) and deep learning (DL) classifiers—Decision Trees, Random Forest, XGBoost, CNNs, RNNs, DNNs, and MLP—on the CSE-CIC-IDS 2018 and LITNET-2020 intrusion datasets, using accuracy, precision, recall, and F1-score as metrics.

Citation

@misc{songma2024epsoid,
  title={Extending Network Intrusion Detection with Enhanced Particle Swarm Optimization Techniques},
  author={Songma et al. (2024)},
  year={2024},
  note={International Journal of Computer Networks & Communications (IJCNC) Vol.16, No.4, July 2024}
}

• arXiv: 2408.07729