Intrusion detection

Overview

The task is to decide, from captured traffic or from an incoming request, whether the input is normal or part of an attack. The two documented settings differ in what is classified:

• Network flows. The harm is a flood that makes a server stop answering, so that the devices depending on it cannot act on their data 1704.02286 §IV. The detector is meant as an early warning, so that a response team can act before the network is disrupted 1704.02286 §IV 1704.02286 §V.
• Web requests. A web application firewall (WAF) checks each request against rules. The paper targets SQL injection, and classifies requests using which rules fire on them 2406.13547 §1 2406.13547 §3.

Two properties shape the design space:

• Labels. Both documented methods are supervised. They need examples in which normal and attack inputs are both labelled 1704.02286 §V 2406.13547 §3. The NetFlow dataset paper supplies labelled flows of this kind, but trains no detector 2503.04404 §4.2 2503.04404 §5.
• Mode of operation. The network-flow detector is treated as an offline analysis of captured traffic 1704.02286 §I. The WAF method scores each request, and its features come from running the WAF on that request 2406.13547 §3 2406.13547 §4.1.

The shared structure of the variants: turn each observation into numeric features, train a classifier on labelled samples, and map its output to a normal or attack decision. The feature step differs most. Traffic statistics are one option; a binary indicator per rule is the other.

Variants

Small feed-forward neural network on traffic features

A feed-forward network with six inputs, one hidden layer of three sigmoid units and one sigmoid output, trained by stochastic gradient descent on a squared-error loss 1704.02286 §III 1704.02286 fig. 1. The forward pass and the error terms are given in equations 1 to 6 and 8 1704.02286 eq. 1-4 1704.02286 eq. 5-6. The paper calls it an "offline IDS" built from an artificial neural network 1704.02286 §I. Card: Threat analysis of IoT networks Using Artificial Neural Network Intrusion Detection System.

The data comes from a testbed of five sensor nodes, four clients and one server relay, with a network tap that captures traffic without changing it 1704.02286 §IV 1704.02286 fig. 2. Attacks are UDP floods: one host for DoS, up to three hosts for DDoS, each sending more than ten million packets 1704.02286 §IV. The labelled set has 3305 samples, 64.18% attack and 35.82% normal 1704.02286 tab. 2. It is split into 2313 training, 496 validation and 496 test samples 1704.02286 §V.

Results are author-reported and come from one classifier with no baseline: 99.4% accuracy over all samples and on the test split 1704.02286 §V 1704.02286 fig. 3. Recall on the attack class, 99.1%, is derived by reading the confusion matrix, not stated by the authors 1704.02286 fig. 3.

Linear and tree models on learned rule weights (ModSec-Learn)

Each SQL-injection rule of the OWASP Core Rule Set (CRS) becomes one binary feature: 1 if the rule fired on the query, 0 otherwise 2406.13547 §3. A linear SVM, a logistic regression (with L1 or L2 penalty) or a random forest is trained on these features 2406.13547 §3. The learned weights replace the fixed severity points that ModSecurity sums to decide whether to block a request 2406.13547 §1 2406.13547 §2.

The paper argues that fixed severities do not fit every protected service, and that rules can overlap 2406.13547 §1. Under L1 regularisation the linear models set some weights to exactly zero, so the matching rules can be dropped. At paranoia level 4 the L1 logistic regression gives zero weight to 18 rules 2406.13547 §4.4. The regularisation strength C is 0.5, chosen from five tested values 2406.13547 §4.1.

Author-reported results use a balanced test set of 10,000 requests and the TPR at 1% false-positive rate 2406.13547 §4.1 2406.13547 §4.2. At paranoia level 4, vanilla ModSecurity reaches 68.55%, and the learned models reach 99.02% to 99.45% 2406.13547 tab. 1. At level 1 all models match vanilla ModSecurity at 92.50% 2406.13547 tab. 1. Card: ModSec-Learn: Boosting ModSecurity with Machine Learning.

Data source: rebuilt NetFlow benchmarks (NF3)

This is a data source, not a detector. The paper rebuilds four public intrusion-detection benchmarks (UNSW-NB15, BoT-IoT, ToN-IoT, CSE-CIC-IDS2018) as NetFlow records. Each record adds flow start and end times and inter-packet arrival time statistics 2503.04404 §4.1 2503.04404 tab. 1. The authors run the nProbe exporter on the original captures, then label each flow from the ground-truth files by timestamp and 5-tuple 2503.04404 §4.2. The four labelled sets hold 2.37 to 27.52 million flows, from 5.40% (UNSW-NB15) to 99.7% (BoT-IoT) malicious 2503.04404 tab. 2. By default nProbe exports a flow at intervals of at most 2 minutes 2503.04404 §5.1; the paper does not discuss how this affects flow length or labels. The analysis is descriptive: flow-length histograms, per-minute series and spectrograms 2503.04404 §5. No model is trained or evaluated 2503.04404 §5 2503.04404 §6, so there are no accuracy figures to compare. The wiki does not redistribute the dataset files; they are on the authors' page 2503.04404 §1. Card: Temporal Analysis of NetFlow Datasets for Network Intrusion Detection Systems.

When to use which

The two variants answer different questions, so the table compares situations rather than rankings. Neither result transfers to a different network, a different WAF or a different base rate without a new evaluation.

Implementation sketch

Language-agnostic pseudocode of the common core. The feature step differs by variant; the classifier and threshold steps are shared. Placeholders mark values the papers do not state.

# Turn one observation into a numeric feature vector  [arxiv:1704.02286 §IV]
# Traffic: summary features of a flow or window; the features are not named
# NetFlow rebuilds list their fields in [arxiv:2503.04404 tab. 1]
# Requests: one binary value per SQLi rule, 1 if the rule fired  [arxiv:2406.13547 §3]
def featurise(sample, rule_ids):
    if sample.kind == "traffic":
        return traffic_features(sample)        # placeholder, not stated
    # Run the WAF on the request, with the rule file for the chosen level
    # [arxiv:2406.13547 §4.1]
    fired = waf_rules_fired(sample.query)
    return [1.0 if r in fired else 0.0 for r in rule_ids]

# Fit a classifier on labelled feature vectors (1 = attack, 0 = normal)
# Network: six inputs, three sigmoid hidden units, one sigmoid output  [arxiv:1704.02286 §III]
# Linear SVM or logistic regression: C = 0.5, L1 or L2 penalty  [arxiv:2406.13547 §4.1]
# Random forest: library defaults  [arxiv:2406.13547 §4.1]
model = fit(X, y)

# Decide with a threshold on the model score  [arxiv:2406.13547 §4.2]
# The network paper does not state its threshold [arxiv:1704.02286 §III]
def detect(x, threshold):
    return model.score(x) >= threshold

# Sweep the threshold, then report TPR at a fixed FPR, not accuracy alone
# [arxiv:2406.13547 §4.2] [arxiv:2406.13547 tab. 1]

Contradictions

• Network paper: text and confusion matrix disagree on the class labels. The text calls true positives attacks "rightly classified" and false positives normal events "classified rightly" 1704.02286 §V. Reading the cells of the matrix, 20 attack samples were labelled normal and no normal sample was labelled attack 1704.02286 fig. 3. This page uses the counts.
• WAF paper: text and table give different relative gains for the linear SVM at level 4. The text gives 44.71% higher 2406.13547 §4.3. The table values, 99.02 against 68.55, give about 44.45% 2406.13547 tab. 1.
• WAF paper: share of rules discarded. The text says more than 30% of rules are discarded 2406.13547 §6. The introduction says 18 of 60, which is exactly 30% 2406.13547 §1. Against the 52 active rules it is about 35%. The paper does not state the denominator it uses.
• NetFlow dataset paper: text and tables disagree. The text places DoS spikes on CSE-CIC-IDS2018 day 5, but Table 4 lists DDoS on that day 2503.04404 §5.3 2503.04404 tab. 4. The text gives 57 features for the nProbe list and 43 for the earlier standard 2503.04404 §4.2 2503.04404 §3. The paper does not reconcile these with Table 1 2503.04404 tab. 1. Check labels and column names against the data.
• Across the papers, the headline numbers are not comparable. One reports accuracy on a dataset that is 64% attack 1704.02286 tab. 2. The other reports TPR at 1% FPR on a balanced SQLi set 2406.13547 §4.1. Their settings, metrics and data differ. The NetFlow paper reports class counts only, so it gives no figure to set against either.

Papers

• Threat analysis of IoT networks Using Artificial Neural Network Intrusion Detection System: a small sigmoid network trained on labelled traffic from a simulated IoT testbed, reporting 99.4% accuracy with no baseline.
• ModSec-Learn: Boosting ModSecurity with Machine Learning: learned weights over ModSecurity SQLi rules, using a linear SVM, logistic regression or random forest, with TPR at 1% FPR reported against vanilla ModSecurity.
• Temporal Analysis of NetFlow Datasets for Network Intrusion Detection Systems: four labelled NetFlow rebuilds with timing features, analysed descriptively; trains no detector.