Nsl Kdd Eval

nsl-kdd-eval

Training a Bidirectional GAN-based One-Class Classifier for Network Intrusion Detection — Xu et al. (2022) (arXiv:2202.01332, 2022)

What this evaluates

Evaluates network intrusion detection systems on imbalanced network traffic data by classifying records as normal or anomalous. It probes the model's ability to handle class imbalance and detect rare attack patterns in high-dimensional feature spaces.

Datasets

• NSL-KDD — total ?; splits: test (22544)

Metrics

• F1 score (primary) — range: [0, 1]
  • Harmonic mean of precision and recall: 2 * (Precision * Recall) / (Precision + Recall).
• Accuracy — range: [0, 1]
  • Ratio of correctly classified samples to total samples: (TP + TN) / (TP + TN + FP + FN).
• Precision — range: [0, 1]
  • Ratio of correctly predicted anomalies to all predicted anomalies: TP / (TP + FP).
• Recall — range: [0, 1]
  • True Positive Rate: TP / (TP + FN).
• AUC_ROC — range: [0, 1]
  • Area under the Receiver Operating Characteristic curve, plotting TPR against FPR across thresholds.

Input / output format

Input: Network traffic records represented as feature vectors.

Output: Binary classification label (normal or anomaly).

Scoring recipe

tp = sum((pred == 1) & (gold == 1))
tn = sum((pred == 0) & (gold == 0))
fp = sum((pred == 1) & (gold == 0))
fn = sum((pred == 0) & (gold == 1))
precision = tp / (tp + fp)
recall = tp / (tp + fn)
f1 = 2 * (precision * recall) / (precision + recall)
accuracy = (tp + tn) / (tp + tn + fp + fn)
return f1, accuracy, precision, recall

Common pitfalls

• The paper uses KDDTrain+ and KDDTest+ subsets of NSL-KDD but does not explicitly state the training split size, only the test size (22,544).
• Metrics are reported as percentages in tables but formulas define them as ratios in [0,1].
• One-class classification is framed as binary anomaly detection, which may cause confusion about thresholding or scoring functions.

Evidence (verbatim from paper)

We use the classification accuracy, precision, recall, and F1 score as the performance metrics to evaluate the performance effectiveness of our proposed model. We use: True Positive (TP) indicates the number of correctly predicted anomalies, True Negative (TN) indicates the number of correctly predicted normal instances, False Positive (FP) indicates the number of normal instances that are misclassified as anomalies, and False Negative (FN) indicates the number of anomalies that are misclassified as normal.

Citation

@misc{xu2022bigan,
  title={Training a Bidirectional GAN-based One-Class Classifier for Network Intrusion Detection},
  author={Xu et al. (2022)},
  year={2022},
  note={arXiv:2202.01332}
}

• arXiv: 2202.01332