qhjqhj00 kddcup1999-iot-eval
Advanced Anomaly Detection and Threat Intelligence in Zero Trust IoT Environments Using Machine Learning — Basharat et al. (2026) (arXiv:2604.23332, 2026)
What this evaluates
Evaluates supervised machine learning classifiers for anomaly detection in IoT network traffic, specifically probing their ability to identify intrusion attack categories under severe class imbalance.
Datasets
- KDD Cup 1999 — total ?; splits: train (-1), test (-1)
Metrics
Accuracy(primary) — range: [0, 1]- Proportion of correctly classified instances out of the total number of instances.
weighted F1-score— range: [0, 1]- Harmonic mean of precision and recall, averaged across all classes weighted by their support to handle class imbalance.
Input / output format
Input: Tabular network traffic features representing connection records, with multi-class labels indicating normal traffic or specific attack types.
Output: Predicted class label for each network connection instance.
Scoring recipe
def compute_metrics(y_true, y_pred):
accuracy = np.sum(y_true == y_pred) / len(y_true)
f1 = f1_score(y_true, y_pred, average='weighted')
return {'accuracy': accuracy, 'weighted_f1': f1}
Common pitfalls
- Class imbalance can artificially inflate accuracy, making models appear effective while missing minority attack classes.
- Sequence models like RNNs perform poorly on this dataset because the features are static tabular records rather than temporal sequences.
- SMOTE improves minority-class detection but does not fully prevent overfitting in high-variance models like Decision Trees.
Evidence (verbatim from paper)
Performance was assessed using Accuracy and weighted F1-score to ensure balanced evaluation across attack categories.
Citation
@misc{basharat2026advanced,
title={Advanced Anomaly Detection and Threat Intelligence in Zero Trust IoT Environments Using Machine Learning},
author={Basharat et al. (2026)},
year={2026},
note={arXiv:2604.23332}
}
- arXiv: 2604.23332