How yuelouis/tlcn-nids-unsw-nb15 works
This repository currently defines a protocol for a planned UNSW-NB15 intrusion-detection benchmark; it does not yet implement model training or evaluation. The documented workflow is to audit data and satisfy protocol gates, then compare supervised and anomaly-detection models across closed-set and leave-one-attack-class-out scenarios, and collect evidence for the research questions. The graph distinguishes planned benchmark stages from present protocol artifacts. Model and execution wiring is not shown because the source package contains only its initializer.
Main entry points: RUN_MATRIX.csv Scenario matrix · nids_benchmark Supervised models · raw Raw data area · experiment_matrix.yaml Experiment config
Components 17
Data governance
- Raw data area
data/raw - Data audit
docs/week_01/DATA_AUDIT_CHECKLIST.md - Gate 1 protocol
docs/protocol/GATE_1_CHECKLIST.md
Experiment design
- Experiment config
configs/experiment_matrix.yaml - Scenario matrix
docs/protocol/RUN_MATRIX.csv
Model families
- Supervised models
src/nids_benchmark - Random Forest
src/nids_benchmark - XGBoost
src/nids_benchmark - Anomaly models
src/nids_benchmark - Isolation Forest
src/nids_benchmark - Autoencoder
src/nids_benchmark
Evaluation evidence
- Metric thresholds
docs/week_01/METRIC_THRESHOLD_SPEC.md - Result schema
docs/protocol/RESULT_SCHEMA.md - RQ evidence plan
docs/protocol/RQ_TO_EVIDENCE.md - Official test set
data/processed
Other components
- Research team
- UNSW-NB15
Connections 17
- Research team → UNSW-NB15: selects dataset
- UNSW-NB15 → Raw data area: provides data
- Research team → Data audit: reviews data
- Raw data area → Data audit: audited by
- Research team → Gate 1 protocol: reviews protocol
- Research team → Experiment config: defines runs
- Experiment config → Scenario matrix: specifies runs
- Scenario matrix → Supervised models: plans comparison
- Scenario matrix → Anomaly models: plans comparison
- Supervised models → Random Forest: includes
- Supervised models → XGBoost: includes
- Anomaly models → Isolation Forest: includes
- Anomaly models → Autoencoder: includes
- Official test set → Metric thresholds: evaluated under
- Metric thresholds → Result schema: constrains metrics
- Result schema → RQ evidence plan: structures evidence
- Research team → RQ evidence plan: collects evidence