Newest papers

GreenNIDS: A Benchmark Workflow and Analysis Dataset for NetFlow Intrusion Detection Experiments

Lilia-Eliana Popescu-Apreutesei, Sabina-Cristiana Necula · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25366 · cited by 0 works (OpenAlex) · open-access PDF

German

Der Vergleich der vorhersehbaren Leistung und der berechnenden Kosten von flussbasierten Eindringlingsdetektionsexperimenten erfordert, dass beide Mengen für jeden Lauf verfügbar sind. GreenNIDS verbindet die Benchmark-Ausführung auf öffentlichen NetFlow-Datenbanksätzen mit einer wiederverwendbaren Analyse-Datenbank. Modellimplementierungen schreiben eine gemeinsame Reihe von Ausgängen, die in eine Run-Level-Tabelle mit Begleittabellen für Modellkonfiguration, Feature-Wert und Trainingsgeschichte eingesetzt werden. Die Run-Level-Tabelle kombiniert vorhersehbare Metriken mit Timing, Durchsatz, Speicherverbrauch und Energieeinschätzungen basierend auf thermischer Designleistung. Eine CPU-Nur-Demonstration umfasst 216

Machine translation (Meta M2M100); the English original follows.

Abstract

Comparing the predictive performance and computational cost of flow-based intrusion detection experiments requires both quantities to be available for each run. GreenNIDS connects benchmark execution on public NetFlow datasets to a reusable analysis dataset. Model implementations write a common set of outputs, which are ingested into a run-level table with companion tables for model configuration, feature importance, and training history. The run-level table combines predictive metrics with timing, throughput, memory use, and energy estimates based on thermal design power. A CPU-only demonstration comprises 216 runs across four dataset families, three versions, and binary and multiclass tasks. Ingestion produces a 216 x 96 analysis table with no duplicate run identifiers and complete Matthews correlation coefficient (MCC) and F1 coverage. Multiclass ROC-AUC is missing for 36 PyTorch runs, making metric availability an explicit part of subsequent comparisons. The stored records support grouped performance and training-time plots, as well as resource screening after execution. Combining task-specific MCC thresholds with limits on training time, peak RAM, and estimated training energy retains 25.0% of the full run collection. These results establish compatibility within the evaluated collection and support comparisons after execution, subject to the recorded preprocessing, execution profile, and approximate energy accounting.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, NetFlow, Data mining, Benchmark (surveying), Intrusion detection system, Workflow

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange