Newest papers

GreenNIDS: A Benchmark Workflow and Analysis Dataset for NetFlow Intrusion Detection Experiments

Lilia-Eliana Popescu-Apreutesei, Sabina-Cristiana Necula · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25366 · cited by 0 works (OpenAlex) · open-access PDF

Portuguese

Comparar o desempenho preditivo e o custo computacional de experimentos de detecção de intrusão baseados em fluxo requer que ambas as quantidades estejam disponíveis para cada execução. O GreenNIDS conecta a execução de benchmark em conjuntos de dados públicos do NetFlow a um conjunto de dados de análise reutilizável. As implementações do modelo escrevem um conjunto comum de saídas, que são ingeridas em uma tabela de nível de execução com tabelas de companheiros para configuração de modelo, importância de recursos e histórico de treinamento. A tabela de nível de execução combina métricas preditivas com o tempo, a capacidade de transmissão, o uso de memória e as estimativas de energia baseadas na potência de design térmico. Uma demonstração de CPU somente consiste em 216 execuções em quatro famílias de

Machine translation (Meta M2M100); the English original follows.

Abstract

Comparing the predictive performance and computational cost of flow-based intrusion detection experiments requires both quantities to be available for each run. GreenNIDS connects benchmark execution on public NetFlow datasets to a reusable analysis dataset. Model implementations write a common set of outputs, which are ingested into a run-level table with companion tables for model configuration, feature importance, and training history. The run-level table combines predictive metrics with timing, throughput, memory use, and energy estimates based on thermal design power. A CPU-only demonstration comprises 216 runs across four dataset families, three versions, and binary and multiclass tasks. Ingestion produces a 216 x 96 analysis table with no duplicate run identifiers and complete Matthews correlation coefficient (MCC) and F1 coverage. Multiclass ROC-AUC is missing for 36 PyTorch runs, making metric availability an explicit part of subsequent comparisons. The stored records support grouped performance and training-time plots, as well as resource screening after execution. Combining task-specific MCC thresholds with limits on training time, peak RAM, and estimated training energy retains 25.0% of the full run collection. These results establish compatibility within the evaluated collection and support comparisons after execution, subject to the recorded preprocessing, execution profile, and approximate energy accounting.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, NetFlow, Data mining, Benchmark (surveying), Intrusion detection system, Workflow

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange