SYNTOLOGY HomeExplorerAtlasCodeMethodologyAboutDevelopersFeedPricing
Paper · 2305.00550 · 2023

SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection

arXiv · PDF · Open in the Atlas

Code that ran

We lifted 3 functions out of this paper's own repositories and ran 0 of them in a sandbox. "Ran" means the function executed on a synthesized input and returned a value. It is not a reproduction of the paper's results.

RepositoryRoleRan
hihey54/pragmaticassessment canonical 0 of 3
FunctionStatusWhere it lives
compute_results Not yet run hihey54/pragmaticassessment/pragmatic_assessment/evaluation/supportFunctions.py
code served (permissive licence) · get_code("3b0a6fccb55d8564")
develop_clf Not yet run hihey54/pragmaticassessment/pragmatic_assessment/evaluation/supportFunctions.py
code served (permissive licence) · get_code("0dfa34ebc868fc0c")
evaluate_clf Not yet run hihey54/pragmaticassessment/pragmatic_assessment/evaluation/supportFunctions.py
code served (permissive licence) · get_code("718e9fb70accb96b")

Repositories linked to this paper

Some links come from the archived Papers with Code dataset (CC BY-SA 4.0): attribution and licence.

Abstract

Machine Learning (ML) has become a valuable asset to solve many real-world tasks. For Network Intrusion Detection (NID), however, scientific advances in ML are still seen with skepticism by practitioners. This disconnection is due to the intrinsically limited scope of research papers, many of which primarily aim to demonstrate new methods ``outperforming'' prior work -- oftentimes overlooking the practical implications for deploying the proposed solutions in real systems. Unfortunately, the value of ML for NID depends on a plethora of factors, such as hardware, that are often neglected in scientific literature. This paper aims to reduce the practitioners' skepticism towards ML for NID by "changing" the evaluation methodology adopted in research. After elucidating which "factors" influence the operational deployment of ML in NID, we propose the notion of "pragmatic assessment", which enable practitioners to gauge the real value of ML methods for NID. Then, we show that the state-of-research hardly allows one to estimate the value of ML for NID. As a constructive step forward, we carry out a pragmatic assessment. We re-assess existing ML methods for NID, focusing on the classification of malicious network traffic, and consider: hundreds of configuration settings; diverse adversarial scenarios; and four hardware platforms. Our large and reproducible evaluations enable estimating the quality of ML for NID. We also validate our claims through a user-study with security practitioners.

For agents

The same record, over MCP at https://syntology.ai/mcp:

get_harvested_code_for_paper("2305.00550")
get_code_for_paper("2305.00550")
have("2305.00550")

Connect an agent — have() is free.