Newest papers

GreenNIDS: A Benchmark Workflow and Analysis Dataset for NetFlow Intrusion Detection Experiments

Lilia-Eliana Popescu-Apreutesei, Sabina-Cristiana Necula · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25366 · cited by 0 works (OpenAlex) · open-access PDF

Russian

Сопоставление предсказуемой производительности и вычислительных затрат экспериментов по обнаружению вторжений на основе потока требует, чтобы оба количества были доступны для каждого запуска. GreenNIDS соединяет сравнительное выполнение на публичных наборах данных NetFlow с набором аналитических данных, которые могут быть использованы повторно. Модельные реализации пишут общий набор выходов, которые вводятся в таблицу на уровне запуска с таблицами сопровождения для конфигурации моделей, важности функций и истории обучения. Таблица на уровне запуска сочетает в себе предсказуемые показатели с временем, пропускной способностью, использованием памяти и оценками энергии на основе тепловой мощности. Демонстрация только с CPU включает 216 выходов по четырем семьям наборов данных, трем

Machine translation (Meta M2M100); the English original follows.

Abstract

Comparing the predictive performance and computational cost of flow-based intrusion detection experiments requires both quantities to be available for each run. GreenNIDS connects benchmark execution on public NetFlow datasets to a reusable analysis dataset. Model implementations write a common set of outputs, which are ingested into a run-level table with companion tables for model configuration, feature importance, and training history. The run-level table combines predictive metrics with timing, throughput, memory use, and energy estimates based on thermal design power. A CPU-only demonstration comprises 216 runs across four dataset families, three versions, and binary and multiclass tasks. Ingestion produces a 216 x 96 analysis table with no duplicate run identifiers and complete Matthews correlation coefficient (MCC) and F1 coverage. Multiclass ROC-AUC is missing for 36 PyTorch runs, making metric availability an explicit part of subsequent comparisons. The stored records support grouped performance and training-time plots, as well as resource screening after execution. Combining task-specific MCC thresholds with limits on training time, peak RAM, and estimated training energy retains 25.0% of the full run collection. These results establish compatibility within the evaluated collection and support comparisons after execution, subject to the recorded preprocessing, execution profile, and approximate energy accounting.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, NetFlow, Data mining, Benchmark (surveying), Intrusion detection system, Workflow

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange