# Rsst Nids Eval

> This evaluation probes a semi-supervised temporal intrusion detection system's ability to classify network traffic flows as benign or malicious under label scarcity, adversarial contamination, and temporal distribution shifts across heterogeneous cloud environments. Use when the user wants to benchmark on CIC-IDS2017, CSE-CIC-IDS2018, UNSW-NB15, or asks about evaluating this task. Reports detection accuracy.

- Skill: `qhjqhj00/rsst-nids-eval` (Agent Skill)
- Install (CLI): `npx skillmds add qhjqhj00/rsst-nids-eval`
- Raw SKILL.md: https://api.skillmd.com/api/skills/qhjqhj00/rsst-nids-eval/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: qhjqhj00 (https://skillmd.com/u/qhjqhj00)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/qhjqhj00/rsst-nids-eval

---


# rsst-nids-eval

> Robust Semi-Supervised Temporal Intrusion Detection for Adversarial Cloud Networks — Chattopadhyay et al. (2026) (arXiv:2604.12655, 2026)

## What this evaluates

This evaluation probes a semi-supervised temporal intrusion detection system's ability to classify network traffic flows as benign or malicious under label scarcity, adversarial contamination, and temporal distribution shifts across heterogeneous cloud environments.

## Datasets

- **CIC-IDS2017** — total 280000; splits: train (180000), val (40000), test (60000)
- **CSE-CIC-IDS2018** — total 120000; splits: test (120000)
- **UNSW-NB15** — total 100000; splits: test (100000)

## Metrics

- `detection accuracy` **(primary)** — range: [0, 1]
  - Proportion of correctly classified flow windows (benign and attack) out of the total evaluated windows. Averaged over 5 independent runs with different random seeds.

## Input / output format

**Input**: Flow-level temporal windows of length T=20 (stride 5) containing F=78 sanitized flow-level features. All identifier, leakage-prone, and dataset-specific fields (timestamps, IPs, ports, FlowIDs) are removed prior to input.

**Output**: Predicted class label per flow window (benign or specific attack type).

## Scoring recipe

```python
def compute_accuracy(predictions, gold_labels):
    correct = sum(1 for p, g in zip(predictions, gold_labels) if p == g)
    return correct / len(gold_labels)

# Average over 5 random seeds
final_score = mean([compute_accuracy(preds, gold) for preds, gold in runs])
# Statistical significance via paired Wilcoxon signed-rank test (p<0.01)
```

## Common pitfalls

- Temporal data leakage: Splits are strictly chronological (e.g., Mon/Tue train, Wed val, Thu/Fri test). Mixing or shuffling days across splits invalidates the temporal drift evaluation.
- Feature leakage: IP addresses, timestamps, FlowIDs, and dataset-specific flags must be strictly removed. Including them allows models to memorize dataset artifacts rather than learn traffic patterns.
- Cross-dataset fine-tuning: Models trained on CIC-IDS2017 must be evaluated on CSE-CIC-IDS2018 and UNSW-NB15 without any fine-tuning or target-domain access.

## Evidence (verbatim from paper)

> outperforming state-of-the-art methods in detection accuracy, label efficiency, and resilience to distributional shifts across heterogeneous cloud environments.

## Citation

```bibtex
@misc{chattopadhyay2026robust,
  title={Robust Semi-Supervised Temporal Intrusion Detection for Adversarial Cloud Networks},
  author={Chattopadhyay et al. (2026)},
  year={2026},
  note={arXiv:2604.12655}
}
```

- arXiv: 2604.12655