Rsst Nids Eval

rsst-nids-eval

Robust Semi-Supervised Temporal Intrusion Detection for Adversarial Cloud Networks — Chattopadhyay et al. (2026) (arXiv:2604.12655, 2026)

What this evaluates

This evaluation probes a semi-supervised temporal intrusion detection system's ability to classify network traffic flows as benign or malicious under label scarcity, adversarial contamination, and temporal distribution shifts across heterogeneous cloud environments.

Datasets

• CIC-IDS2017 — total 280000; splits: train (180000), val (40000), test (60000)
• CSE-CIC-IDS2018 — total 120000; splits: test (120000)
• UNSW-NB15 — total 100000; splits: test (100000)

Metrics

• detection accuracy (primary) — range: [0, 1]
  • Proportion of correctly classified flow windows (benign and attack) out of the total evaluated windows. Averaged over 5 independent runs with different random seeds.

Input / output format

Input: Flow-level temporal windows of length T=20 (stride 5) containing F=78 sanitized flow-level features. All identifier, leakage-prone, and dataset-specific fields (timestamps, IPs, ports, FlowIDs) are removed prior to input.

Output: Predicted class label per flow window (benign or specific attack type).

Scoring recipe

def compute_accuracy(predictions, gold_labels):
    correct = sum(1 for p, g in zip(predictions, gold_labels) if p == g)
    return correct / len(gold_labels)

# Average over 5 random seeds
final_score = mean([compute_accuracy(preds, gold) for preds, gold in runs])
# Statistical significance via paired Wilcoxon signed-rank test (p<0.01)

Common pitfalls

• Temporal data leakage: Splits are strictly chronological (e.g., Mon/Tue train, Wed val, Thu/Fri test). Mixing or shuffling days across splits invalidates the temporal drift evaluation.
• Feature leakage: IP addresses, timestamps, FlowIDs, and dataset-specific flags must be strictly removed. Including them allows models to memorize dataset artifacts rather than learn traffic patterns.
• Cross-dataset fine-tuning: Models trained on CIC-IDS2017 must be evaluated on CSE-CIC-IDS2018 and UNSW-NB15 without any fine-tuning or target-domain access.

Evidence (verbatim from paper)

outperforming state-of-the-art methods in detection accuracy, label efficiency, and resilience to distributional shifts across heterogeneous cloud environments.

Citation

@misc{chattopadhyay2026robust,
  title={Robust Semi-Supervised Temporal Intrusion Detection for Adversarial Cloud Networks},
  author={Chattopadhyay et al. (2026)},
  year={2026},
  note={arXiv:2604.12655}
}

• arXiv: 2604.12655