Newest papers

GreenNIDS: A Benchmark Workflow and Analysis Dataset for NetFlow Intrusion Detection Experiments

Lilia-Eliana Popescu-Apreutesei, Sabina-Cristiana Necula · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25366 · cited by 0 works (OpenAlex) · open-access PDF

Spanish

Comparar el rendimiento predictivo y el coste computacional de los experimentos de detección de intrusiones basados en flujo requiere que ambas cantidades estén disponibles para cada ejecución. GreenNIDS conecta la ejecución de referencia en los conjuntos de datos públicos de NetFlow a un conjunto de datos de análisis reutilizables. Las implementaciones del modelo escriben un conjunto común de salidas, que se ingiere en una tabla de nivel de ejecución con tablas de compañeros para la configuración del modelo, la importancia de las características y el historial de entrenamiento. La tabla de ejecución combina métricas predictivas con el tiempo, el rendimiento, el uso de la memoria y las estimaciones de la energía basadas en la potencia de diseño térmico. Una demostración de CPU solo consiste en 216 ejecuciones en cuatro familias de

Machine translation (Meta M2M100); the English original follows.

Abstract

Comparing the predictive performance and computational cost of flow-based intrusion detection experiments requires both quantities to be available for each run. GreenNIDS connects benchmark execution on public NetFlow datasets to a reusable analysis dataset. Model implementations write a common set of outputs, which are ingested into a run-level table with companion tables for model configuration, feature importance, and training history. The run-level table combines predictive metrics with timing, throughput, memory use, and energy estimates based on thermal design power. A CPU-only demonstration comprises 216 runs across four dataset families, three versions, and binary and multiclass tasks. Ingestion produces a 216 x 96 analysis table with no duplicate run identifiers and complete Matthews correlation coefficient (MCC) and F1 coverage. Multiclass ROC-AUC is missing for 36 PyTorch runs, making metric availability an explicit part of subsequent comparisons. The stored records support grouped performance and training-time plots, as well as resource screening after execution. Combining task-specific MCC thresholds with limits on training time, peak RAM, and estimated training energy retains 25.0% of the full run collection. These results establish compatibility within the evaluated collection and support comparisons after execution, subject to the recorded preprocessing, execution profile, and approximate energy accounting.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, NetFlow, Data mining, Benchmark (surveying), Intrusion detection system, Workflow

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange