# yuelouis/tlcn-nids-unsw-nb15 architecture

> Architecture diagram of the GitHub repository yuelouis/tlcn-nids-unsw-nb15, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/yuelouis/tlcn-nids-unsw-nb15
- Repository: https://github.com/yuelouis/tlcn-nids-unsw-nb15

## Overview

This repository currently defines a protocol for a planned UNSW-NB15 intrusion-detection benchmark; it does not yet implement model training or evaluation. The documented workflow is to audit data and satisfy protocol gates, then compare supervised and anomaly-detection models across closed-set and leave-one-attack-class-out scenarios, and collect evidence for the research questions. The graph distinguishes planned benchmark stages from present protocol artifacts. Model and execution wiring is not shown because the source package contains only its initializer.

Main entry points: [`docs/protocol/RUN_MATRIX.csv`](https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/docs/protocol/RUN_MATRIX.csv) (Scenario matrix), [`src/nids_benchmark`](https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/src/nids_benchmark) (Supervised models), [`data/raw`](https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/data/raw) (Raw data area), [`configs/experiment_matrix.yaml`](https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/configs/experiment_matrix.yaml) (Experiment config)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_data["Data governance"]
  node_raw_data[("Raw data area")]
  node_data_audit["Data audit"]
  node_gate1["Gate 1 protocol"]
end

subgraph group_design["Experiment design"]
  node_protocol_config["Experiment config"]
  node_scenarios["Scenario matrix<br/>[RUN_MATRIX.csv]"]
end

subgraph group_models["Model families"]
  node_supervised["Supervised models"]
  node_rf["Random Forest"]
  node_xgb["XGBoost"]
  node_anomaly["Anomaly models"]
  node_iforest["Isolation Forest"]
  node_autoencoder["Autoencoder"]
end

subgraph group_evidence["Evaluation evidence"]
  node_thresholds["Metric thresholds"]
  node_result_schema["Result schema<br/>[RESULT_SCHEMA.md]"]
  node_rq_evidence["RQ evidence plan<br/>[RQ_TO_EVIDENCE.md]"]
  node_official_test[("Official test set")]
end

node_researcher(("Research team"))
node_unsw[("UNSW-NB15")]

node_researcher -->|"selects dataset"| node_unsw
node_unsw -->|"provides data"| node_raw_data
node_researcher -->|"reviews data"| node_data_audit
node_raw_data -->|"audited by"| node_data_audit
node_researcher -->|"reviews protocol"| node_gate1
node_researcher -->|"defines runs"| node_protocol_config
node_protocol_config -->|"specifies runs"| node_scenarios
node_scenarios -.->|"plans comparison"| node_supervised
node_scenarios -.->|"plans comparison"| node_anomaly
node_supervised -.->|"includes"| node_rf
node_supervised -.->|"includes"| node_xgb
node_anomaly -.->|"includes"| node_iforest
node_anomaly -.->|"includes"| node_autoencoder
node_official_test -.->|"evaluated under"| node_thresholds
node_thresholds -->|"constrains metrics"| node_result_schema
node_result_schema -->|"structures evidence"| node_rq_evidence
node_researcher -->|"collects evidence"| node_rq_evidence

click node_raw_data "https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/data/raw"
click node_data_audit "https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/docs/week_01/DATA_AUDIT_CHECKLIST.md"
click node_gate1 "https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/docs/protocol/GATE_1_CHECKLIST.md"
click node_protocol_config "https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/configs/experiment_matrix.yaml"
click node_scenarios "https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/docs/protocol/RUN_MATRIX.csv"
click node_supervised "https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/src/nids_benchmark"
click node_rf "https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/src/nids_benchmark"
click node_xgb "https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/src/nids_benchmark"
click node_anomaly "https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/src/nids_benchmark"
click node_iforest "https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/src/nids_benchmark"
click node_autoencoder "https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/src/nids_benchmark"
click node_thresholds "https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/docs/week_01/METRIC_THRESHOLD_SPEC.md"
click node_result_schema "https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/docs/protocol/RESULT_SCHEMA.md"
click node_rq_evidence "https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/docs/protocol/RQ_TO_EVIDENCE.md"
click node_official_test "https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/data/processed"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_raw_data,node_data_audit,node_gate1 toneBlue
class node_protocol_config,node_scenarios,node_unsw toneAmber
class node_supervised,node_rf,node_xgb,node_anomaly,node_iforest,node_autoencoder toneMint
class node_thresholds,node_result_schema,node_rq_evidence,node_official_test toneRose
class node_researcher toneIndigo
```

## Components

### Data governance

- [Raw data area](https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/data/raw): `data/raw`
- [Data audit](https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/docs/week_01/DATA_AUDIT_CHECKLIST.md): `docs/week_01/DATA_AUDIT_CHECKLIST.md`
- [Gate 1 protocol](https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/docs/protocol/GATE_1_CHECKLIST.md): `docs/protocol/GATE_1_CHECKLIST.md`

### Experiment design

- [Experiment config](https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/configs/experiment_matrix.yaml): `configs/experiment_matrix.yaml`
- [Scenario matrix](https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/docs/protocol/RUN_MATRIX.csv): `docs/protocol/RUN_MATRIX.csv`

### Model families

- [Supervised models](https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/src/nids_benchmark): `src/nids_benchmark`
- [Random Forest](https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/src/nids_benchmark): `src/nids_benchmark`
- [XGBoost](https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/src/nids_benchmark): `src/nids_benchmark`
- [Anomaly models](https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/src/nids_benchmark): `src/nids_benchmark`
- [Isolation Forest](https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/src/nids_benchmark): `src/nids_benchmark`
- [Autoencoder](https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/src/nids_benchmark): `src/nids_benchmark`

### Evaluation evidence

- [Metric thresholds](https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/docs/week_01/METRIC_THRESHOLD_SPEC.md): `docs/week_01/METRIC_THRESHOLD_SPEC.md`
- [Result schema](https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/docs/protocol/RESULT_SCHEMA.md): `docs/protocol/RESULT_SCHEMA.md`
- [RQ evidence plan](https://github.com/yuelouis/tlcn-nids-unsw-nb15/blob/main/docs/protocol/RQ_TO_EVIDENCE.md): `docs/protocol/RQ_TO_EVIDENCE.md`
- [Official test set](https://github.com/yuelouis/tlcn-nids-unsw-nb15/tree/main/data/processed): `data/processed`

### Other components

- **Research team**
- **UNSW-NB15**

## Connections

- Research team → UNSW-NB15: selects dataset
- UNSW-NB15 → Raw data area: provides data
- Research team → Data audit: reviews data
- Raw data area → Data audit: audited by
- Research team → Gate 1 protocol: reviews protocol
- Research team → Experiment config: defines runs
- Experiment config → Scenario matrix: specifies runs
- Scenario matrix → Supervised models: plans comparison
- Scenario matrix → Anomaly models: plans comparison
- Supervised models → Random Forest: includes
- Supervised models → XGBoost: includes
- Anomaly models → Isolation Forest: includes
- Anomaly models → Autoencoder: includes
- Official test set → Metric thresholds: evaluated under
- Metric thresholds → Result schema: constrains metrics
- Result schema → RQ evidence plan: structures evidence
- Research team → RQ evidence plan: collects evidence