# Kddcup1999 Iot Eval

> Evaluates supervised machine learning classifiers for anomaly detection in IoT network traffic, specifically probing their ability to identify intrusion attack categories under severe class imbalance. Use when the user wants to benchmark on KDD Cup 1999, or asks about evaluating this task. Reports Accuracy.

- Skill: `qhjqhj00/kddcup1999-iot-eval` (Agent Skill)
- Install (CLI): `npx skillmds add qhjqhj00/kddcup1999-iot-eval`
- Raw SKILL.md: https://api.skillmd.com/api/skills/qhjqhj00/kddcup1999-iot-eval/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: qhjqhj00 (https://skillmd.com/u/qhjqhj00)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/qhjqhj00/kddcup1999-iot-eval

---


# kddcup1999-iot-eval

> Advanced Anomaly Detection and Threat Intelligence in Zero Trust IoT Environments Using Machine Learning — Basharat et al. (2026) (arXiv:2604.23332, 2026)

## What this evaluates

Evaluates supervised machine learning classifiers for anomaly detection in IoT network traffic, specifically probing their ability to identify intrusion attack categories under severe class imbalance.

## Datasets

- **KDD Cup 1999** — total ?; splits: train (-1), test (-1)

## Metrics

- `Accuracy` **(primary)** — range: [0, 1]
  - Proportion of correctly classified instances out of the total number of instances.
- `weighted F1-score` — range: [0, 1]
  - Harmonic mean of precision and recall, averaged across all classes weighted by their support to handle class imbalance.

## Input / output format

**Input**: Tabular network traffic features representing connection records, with multi-class labels indicating normal traffic or specific attack types.

**Output**: Predicted class label for each network connection instance.

## Scoring recipe

```python
def compute_metrics(y_true, y_pred):
    accuracy = np.sum(y_true == y_pred) / len(y_true)
    f1 = f1_score(y_true, y_pred, average='weighted')
    return {'accuracy': accuracy, 'weighted_f1': f1}
```

## Common pitfalls

- Class imbalance can artificially inflate accuracy, making models appear effective while missing minority attack classes.
- Sequence models like RNNs perform poorly on this dataset because the features are static tabular records rather than temporal sequences.
- SMOTE improves minority-class detection but does not fully prevent overfitting in high-variance models like Decision Trees.

## Evidence (verbatim from paper)

> Performance was assessed using Accuracy and weighted F1-score to ensure balanced evaluation across attack categories.

## Citation

```bibtex
@misc{basharat2026advanced,
  title={Advanced Anomaly Detection and Threat Intelligence in Zero Trust IoT Environments Using Machine Learning},
  author={Basharat et al. (2026)},
  year={2026},
  note={arXiv:2604.23332}
}
```

- arXiv: 2604.23332