# Kdd99 Intrusion Detection Eval

> Evaluates network intrusion detection models by measuring per-class detection rates and false positive rates across normal and attack traffic categories. Probes the classifier's ability to balance sensitivity to rare attack types while minimizing misclassification of benign traffic. Use when the user wants to benchmark on KDD99, or asks about evaluating this task. Reports Detection Rate.

- Skill: `qhjqhj00/kdd99-intrusion-detection-eval` (Agent Skill)
- Install (CLI): `npx skillmds add qhjqhj00/kdd99-intrusion-detection-eval`
- Raw SKILL.md: https://api.skillmd.com/api/skills/qhjqhj00/kdd99-intrusion-detection-eval/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: qhjqhj00 (https://skillmd.com/u/qhjqhj00)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/qhjqhj00/kdd99-intrusion-detection-eval

---


# kdd99-intrusion-detection-eval

> Attribute Weighting with Adaptive NBTree for Reducing False Positives in Intrusion Detection — Farid et al. (2010) (arXiv:1005.0919, 2010)

## What this evaluates

Evaluates network intrusion detection models by measuring per-class detection rates and false positive rates across normal and attack traffic categories. Probes the classifier's ability to balance sensitivity to rare attack types while minimizing misclassification of benign traffic.

## Datasets

- **KDD99** — total ?; splits: test (-1)

## Metrics

- `Detection Rate` **(primary)** — range: percent
  - Per-class recall expressed as a percentage. Calculated as (True Positives / (True Positives + False Negatives)) * 100 for each attack class and normal traffic.
- `False Positive Rate` — range: percent
  - Per-class false alarm rate expressed as a percentage. Calculated as (False Positives / (False Positives + True Negatives)) * 100, where false positives are normal traffic instances misclassified as a specific attack class.

## Input / output format

**Input**: Network traffic records represented as numerical/categorical features (originally 41 attributes, or a reduced 12-attribute subset), paired with a ground-truth class label (Normal, Probe, DoS, U2R, or R2L).

**Output**: A single predicted class label per traffic record (Normal, Probe, DoS, U2R, or R2L).

## Scoring recipe

```python
def compute_metrics(predictions, labels):
    classes = ['Normal', 'Probe', 'DoS', 'U2R', 'R2L']
    results = {}
    for cls in classes:
        tp = sum(1 for p, l in zip(predictions, labels) if p == cls and l == cls)
        fn = sum(1 for p, l in zip(predictions, labels) if p != cls and l == cls)
        fp = sum(1 for p, l in zip(predictions, labels) if p == cls and l != cls)
        tn = sum(1 for p, l in zip(predictions, labels) if p != cls and l != cls)
        det_rate = (tp / (tp + fn)) * 100 if (tp + fn) > 0 else 0
        fp_rate = (fp / (fp + tn)) * 100 if (fp + tn) > 0 else 0
        results[cls] = {'Detection Rate': det_rate, 'False Positive Rate': fp_rate}
    return results
```

## Common pitfalls

- Detection Rate here refers to per-class recall, not overall accuracy or macro-averaged recall.
- False Positives (%) is calculated per class (normal traffic misclassified as that specific attack), not as a global false positive rate.
- Comparisons between the proposed algorithm and baselines (NB, C4.5, SVM, etc.) mix different feature sets (12 vs 41 attributes), which can confound performance differences.

## Evidence (verbatim from paper)

> The performance of our proposed algorithm on 12 attributes in KDD99 dataset is listed in Table IV.

TABLE IV. PERFORMANCE OF PROPOSED ALGORITHM ON KDD99 DATASET  

<table><tr><td>Classes</td><td>Detection Rates (%)</td><td>False Positives (%)</td></tr>...

## Citation

```bibtex
@misc{farid2010attributeweighting,
  title={Attribute Weighting with Adaptive NBTree for Reducing False Positives in Intrusion Detection},
  author={Farid et al. (2010)},
  year={2010},
  note={arXiv:1005.0919}
}
```

- arXiv: 1005.0919