--- kind: concept slug: intrusion-detection title: Intrusion detection summary: >- Flags attack traffic: network floods (DoS/DDoS) and SQL injection in web requests. Two supervised methods, each author-reported on one setup: a small sigmoid network on IoT traffic (99.4% accuracy), and learned weights over ModSecurity rules (99.02–99.45% TPR at 1% FPR, paranoia level 4, vs 68.55% for stock rules). Also a labelled NetFlow dataset rebuild; it trains no detector. tags: [security, network-traffic, web-security, supervised-learning, iot] papers: ["1704.02286", "2406.13547", "2503.04404"] related: [anomaly-detection, benchmark-validity, feature-selection, support-vector-machine, random-forest, multi-layer-perceptron] status: draft updated_at: 2026-10-19 --- ## Overview The task is to decide, from captured traffic or from an incoming request, whether the input is normal or part of an attack. The two documented settings differ in what is classified: - **Network flows.** The harm is a flood that makes a server stop answering, so that the devices depending on it cannot act on their data [arxiv:1704.02286 §IV]. The detector is meant as an early warning, so that a response team can act before the network is disrupted [arxiv:1704.02286 §IV] [arxiv:1704.02286 §V]. - **Web requests.** A web application firewall (WAF) checks each request against rules. The paper targets SQL injection, and classifies requests using which rules fire on them [arxiv:2406.13547 §1] [arxiv:2406.13547 §3]. Two properties shape the design space: - **Labels.** Both documented methods are supervised. They need examples in which normal and attack inputs are both labelled [arxiv:1704.02286 §V] [arxiv:2406.13547 §3]. The NetFlow dataset paper supplies labelled flows of this kind, but trains no detector [arxiv:2503.04404 §4.2] [arxiv:2503.04404 §5]. - **Mode of operation.** The network-flow detector is treated as an offline analysis of captured traffic [arxiv:1704.02286 §I]. The WAF method scores each request, and its features come from running the WAF on that request [arxiv:2406.13547 §3] [arxiv:2406.13547 §4.1]. The shared structure of the variants: turn each observation into numeric features, train a classifier on labelled samples, and map its output to a normal or attack decision. The feature step differs most. Traffic statistics are one option; a binary indicator per rule is the other. ## Variants ### Small feed-forward neural network on traffic features A feed-forward network with six inputs, one hidden layer of three sigmoid units and one sigmoid output, trained by stochastic gradient descent on a squared-error loss [arxiv:1704.02286 §III] [arxiv:1704.02286 fig. 1]. The forward pass and the error terms are given in equations 1 to 6 and 8 [arxiv:1704.02286 eq. 1-4] [arxiv:1704.02286 eq. 5-6]. The paper calls it an "offline IDS" built from an artificial neural network [arxiv:1704.02286 §I]. Card: [Threat analysis of IoT networks Using Artificial Neural Network Intrusion Detection System](/papers/1704.02286). The data comes from a testbed of five sensor nodes, four clients and one server relay, with a network tap that captures traffic without changing it [arxiv:1704.02286 §IV] [arxiv:1704.02286 fig. 2]. Attacks are UDP floods: one host for DoS, up to three hosts for DDoS, each sending more than ten million packets [arxiv:1704.02286 §IV]. The labelled set has 3305 samples, 64.18% attack and 35.82% normal [arxiv:1704.02286 tab. 2]. It is split into 2313 training, 496 validation and 496 test samples [arxiv:1704.02286 §V]. Results are author-reported and come from one classifier with no baseline: 99.4% accuracy over all samples and on the test split [arxiv:1704.02286 §V] [arxiv:1704.02286 fig. 3]. Recall on the attack class, 99.1%, is derived by reading the confusion matrix, not stated by the authors [arxiv:1704.02286 fig. 3]. ### Linear and tree models on learned rule weights (ModSec-Learn) Each SQL-injection rule of the OWASP Core Rule Set (CRS) becomes one binary feature: 1 if the rule fired on the query, 0 otherwise [arxiv:2406.13547 §3]. A linear SVM, a logistic regression (with L1 or L2 penalty) or a random forest is trained on these features [arxiv:2406.13547 §3]. The learned weights replace the fixed severity points that ModSecurity sums to decide whether to block a request [arxiv:2406.13547 §1] [arxiv:2406.13547 §2]. The paper argues that fixed severities do not fit every protected service, and that rules can overlap [arxiv:2406.13547 §1]. Under L1 regularisation the linear models set some weights to exactly zero, so the matching rules can be dropped. At paranoia level 4 the L1 logistic regression gives zero weight to 18 rules [arxiv:2406.13547 §4.4]. The regularisation strength C is 0.5, chosen from five tested values [arxiv:2406.13547 §4.1]. Author-reported results use a balanced test set of 10,000 requests and the TPR at 1% false-positive rate [arxiv:2406.13547 §4.1] [arxiv:2406.13547 §4.2]. At paranoia level 4, vanilla ModSecurity reaches 68.55%, and the learned models reach 99.02% to 99.45% [arxiv:2406.13547 tab. 1]. At level 1 all models match vanilla ModSecurity at 92.50% [arxiv:2406.13547 tab. 1]. Card: [ModSec-Learn: Boosting ModSecurity with Machine Learning](/papers/2406.13547). ### Data source: rebuilt NetFlow benchmarks (NF3) This is a data source, not a detector. The paper rebuilds four public intrusion-detection benchmarks (UNSW-NB15, BoT-IoT, ToN-IoT, CSE-CIC-IDS2018) as NetFlow records. Each record adds flow start and end times and inter-packet arrival time statistics [arxiv:2503.04404 §4.1] [arxiv:2503.04404 tab. 1]. The authors run the nProbe exporter on the original captures, then label each flow from the ground-truth files by timestamp and 5-tuple [arxiv:2503.04404 §4.2]. The four labelled sets hold 2.37 to 27.52 million flows, from 5.40% (UNSW-NB15) to 99.7% (BoT-IoT) malicious [arxiv:2503.04404 tab. 2]. By default nProbe exports a flow at intervals of at most 2 minutes [arxiv:2503.04404 §5.1]; the paper does not discuss how this affects flow length or labels. The analysis is descriptive: flow-length histograms, per-minute series and spectrograms [arxiv:2503.04404 §5]. No model is trained or evaluated [arxiv:2503.04404 §5] [arxiv:2503.04404 §6], so there are no accuracy figures to compare. The wiki does not redistribute the dataset files; they are on the authors' page [arxiv:2503.04404 §1]. Card: [Temporal Analysis of NetFlow Datasets for Network Intrusion Detection Systems](/papers/2503.04404). ## When to use which The two variants answer different questions, so the table compares situations rather than rankings. Neither result transfers to a different network, a different WAF or a different base rate without a new evaluation. | Situation | Use | Why | |---|---|---| | You can capture labelled normal and attack traffic from your own network, and can summarise each flow as numbers | A small supervised network as a first baseline | This is the setting of the network-flow paper. Its numbers come from one simulated setup [arxiv:1704.02286 §IV] [arxiv:1704.02286 §V] | | You run a rule-based WAF and want the rule weights learned from labelled requests | Linear model over rule-fired features | The paper replaces fixed severities with learned weights on a balanced SQLi test set [arxiv:2406.13547 §4.1] [arxiv:2406.13547 tab. 1] | | You want fewer rules to maintain or evaluate | L1-regularised linear model | At paranoia level 4 it zeroes 18 rules [arxiv:2406.13547 §4.4] | | You want a non-linear decision on rule features | Random forest | The paper reports the best TPR at level 3 and 4 [arxiv:2406.13547 tab. 1], and notes that a non-linear model is harder to place inside ModSecurity [arxiv:2406.13547 §3] | | You need to reproduce the reported numbers | Not possible from the papers alone | Some settings are left open: the network's input features [arxiv:1704.02286 §III]. For the WAF, the paper gives the regularisation strength and says the other settings were left at their defaults [arxiv:2406.13547 §4.1] | | Attacks in deployment differ from the captured ones | Treat the result as untested | Each paper covers one attack family: UDP floods [arxiv:1704.02286 §IV], SQL injection [arxiv:2406.13547 §6] | | Your traffic base rate differs from the test set | Measure precision and false alarms on your own data | The WAF test set is balanced, 5,000 per class [arxiv:2406.13547 §4.1]. The network paper reports accuracy and attack recall only [arxiv:1704.02286 §V] | | You need labelled network-flow data with timing features | Use the NF3 rebuilds as a data source, after checking their labels | Each set has a binary and an attack-class label, but the label matching tolerance is not stated [arxiv:2503.04404 §4.2] | | You need a trained detector or a baseline comparison from this work | Not available from these papers | The NetFlow paper trains no model [arxiv:2503.04404 §5] [arxiv:2503.04404 §6] | | You must control latency or per-request cost | Measure it yourself | The WAF method runs the WAF to build each feature [arxiv:2406.13547 §3] [arxiv:2406.13547 §4.1]. The network paper is offline and measures no latency [arxiv:1704.02286 §I] | ## Implementation sketch Language-agnostic pseudocode of the common core. The feature step differs by variant; the classifier and threshold steps are shared. Placeholders mark values the papers do not state. ```pseudocode # Turn one observation into a numeric feature vector [arxiv:1704.02286 §IV] # Traffic: summary features of a flow or window; the features are not named # NetFlow rebuilds list their fields in [arxiv:2503.04404 tab. 1] # Requests: one binary value per SQLi rule, 1 if the rule fired [arxiv:2406.13547 §3] def featurise(sample, rule_ids): if sample.kind == "traffic": return traffic_features(sample) # placeholder, not stated # Run the WAF on the request, with the rule file for the chosen level # [arxiv:2406.13547 §4.1] fired = waf_rules_fired(sample.query) return [1.0 if r in fired else 0.0 for r in rule_ids] ``` ```pseudocode # Fit a classifier on labelled feature vectors (1 = attack, 0 = normal) # Network: six inputs, three sigmoid hidden units, one sigmoid output [arxiv:1704.02286 §III] # Linear SVM or logistic regression: C = 0.5, L1 or L2 penalty [arxiv:2406.13547 §4.1] # Random forest: library defaults [arxiv:2406.13547 §4.1] model = fit(X, y) ``` ```pseudocode # Decide with a threshold on the model score [arxiv:2406.13547 §4.2] # The network paper does not state its threshold [arxiv:1704.02286 §III] def detect(x, threshold): return model.score(x) >= threshold # Sweep the threshold, then report TPR at a fixed FPR, not accuracy alone # [arxiv:2406.13547 §4.2] [arxiv:2406.13547 tab. 1] ``` ## Contradictions - **Network paper: text and confusion matrix disagree on the class labels.** The text calls true positives attacks "rightly classified" and false positives normal events "classified rightly" [arxiv:1704.02286 §V]. Reading the cells of the matrix, 20 attack samples were labelled normal and no normal sample was labelled attack [arxiv:1704.02286 fig. 3]. This page uses the counts. - **WAF paper: text and table give different relative gains for the linear SVM at level 4.** The text gives 44.71% higher [arxiv:2406.13547 §4.3]. The table values, 99.02 against 68.55, give about 44.45% [arxiv:2406.13547 tab. 1]. - **WAF paper: share of rules discarded.** The text says more than 30% of rules are discarded [arxiv:2406.13547 §6]. The introduction says 18 of 60, which is exactly 30% [arxiv:2406.13547 §1]. Against the 52 active rules it is about 35%. The paper does not state the denominator it uses. - **NetFlow dataset paper: text and tables disagree.** The text places DoS spikes on CSE-CIC-IDS2018 day 5, but Table 4 lists DDoS on that day [arxiv:2503.04404 §5.3] [arxiv:2503.04404 tab. 4]. The text gives 57 features for the nProbe list and 43 for the earlier standard [arxiv:2503.04404 §4.2] [arxiv:2503.04404 §3]. The paper does not reconcile these with Table 1 [arxiv:2503.04404 tab. 1]. Check labels and column names against the data. - **Across the papers, the headline numbers are not comparable.** One reports accuracy on a dataset that is 64% attack [arxiv:1704.02286 tab. 2]. The other reports TPR at 1% FPR on a balanced SQLi set [arxiv:2406.13547 §4.1]. Their settings, metrics and data differ. The NetFlow paper reports class counts only, so it gives no figure to set against either. ## Papers - [Threat analysis of IoT networks Using Artificial Neural Network Intrusion Detection System](/papers/1704.02286): a small sigmoid network trained on labelled traffic from a simulated IoT testbed, reporting 99.4% accuracy with no baseline. - [ModSec-Learn: Boosting ModSecurity with Machine Learning](/papers/2406.13547): learned weights over ModSecurity SQLi rules, using a linear SVM, logistic regression or random forest, with TPR at 1% FPR reported against vanilla ModSecurity. - [Temporal Analysis of NetFlow Datasets for Network Intrusion Detection Systems](/papers/2503.04404): four labelled NetFlow rebuilds with timing features, analysed descriptively; trains no detector.