Kdd99 Intrusion Detection Eval

kdd99-intrusion-detection-eval

Attribute Weighting with Adaptive NBTree for Reducing False Positives in Intrusion Detection — Farid et al. (2010) (arXiv:1005.0919, 2010)

What this evaluates

Evaluates network intrusion detection models by measuring per-class detection rates and false positive rates across normal and attack traffic categories. Probes the classifier's ability to balance sensitivity to rare attack types while minimizing misclassification of benign traffic.

Datasets

• KDD99 — total ?; splits: test (-1)

Metrics

• Detection Rate (primary) — range: percent
  • Per-class recall expressed as a percentage. Calculated as (True Positives / (True Positives + False Negatives)) * 100 for each attack class and normal traffic.
• False Positive Rate — range: percent
  • Per-class false alarm rate expressed as a percentage. Calculated as (False Positives / (False Positives + True Negatives)) * 100, where false positives are normal traffic instances misclassified as a specific attack class.

Input / output format

Input: Network traffic records represented as numerical/categorical features (originally 41 attributes, or a reduced 12-attribute subset), paired with a ground-truth class label (Normal, Probe, DoS, U2R, or R2L).

Output: A single predicted class label per traffic record (Normal, Probe, DoS, U2R, or R2L).

Scoring recipe

def compute_metrics(predictions, labels):
    classes = ['Normal', 'Probe', 'DoS', 'U2R', 'R2L']
    results = {}
    for cls in classes:
        tp = sum(1 for p, l in zip(predictions, labels) if p == cls and l == cls)
        fn = sum(1 for p, l in zip(predictions, labels) if p != cls and l == cls)
        fp = sum(1 for p, l in zip(predictions, labels) if p == cls and l != cls)
        tn = sum(1 for p, l in zip(predictions, labels) if p != cls and l != cls)
        det_rate = (tp / (tp + fn)) * 100 if (tp + fn) > 0 else 0
        fp_rate = (fp / (fp + tn)) * 100 if (fp + tn) > 0 else 0
        results[cls] = {'Detection Rate': det_rate, 'False Positive Rate': fp_rate}
    return results

Common pitfalls

• Detection Rate here refers to per-class recall, not overall accuracy or macro-averaged recall.
• False Positives (%) is calculated per class (normal traffic misclassified as that specific attack), not as a global false positive rate.
• Comparisons between the proposed algorithm and baselines (NB, C4.5, SVM, etc.) mix different feature sets (12 vs 41 attributes), which can confound performance differences.

Evidence (verbatim from paper)

The performance of our proposed algorithm on 12 attributes in KDD99 dataset is listed in Table IV.

TABLE IV. PERFORMANCE OF PROPOSED ALGORITHM ON KDD99 DATASET

Citation

@misc{farid2010attributeweighting,
  title={Attribute Weighting with Adaptive NBTree for Reducing False Positives in Intrusion Detection},
  author={Farid et al. (2010)},
  year={2010},
  note={arXiv:1005.0919}
}

• arXiv: 1005.0919