Cicids2017 Eval

---
name: cicids2017-eval
description: Evaluates network intrusion detection capability by classifying network traffic flows as benign or malicious (or specific attack types) using graph-structured representations of network connections. It probes the model's ability to learn from adaptive graph construction and contrastive learning under resource-constrained conditions. Use when the user wants to benchmark on CICIDS2017, or asks about evaluating this task. Reports accuracy.
metadata:
  skill_kind: dataset_eval
  source_arxiv: 2503.00961
  bibtex_key: jahin2025cagn_gat_fusion
  confidence: medium
---

# cicids2017-eval

> CAGN-GAT Fusion: A Hybrid Contrastive Attentive Graph Neural Network for Network Intrusion Detection — Md Abrar Jahin et al. (2025) (arXiv:2503.00961, 2025)

## What this evaluates

Evaluates network intrusion detection capability by classifying network traffic flows as benign or malicious (or specific attack types) using graph-structured representations of network connections. It probes the model's ability to learn from adaptive graph construction and contrastive learning under resource-constrained conditions.

## Datasets

- **CICIDS2017** — total ?; splits: test (-1)

## Metrics

- `accuracy` **(primary)** — range: [0, 1]
  - Proportion of correctly classified instances out of the total number of instances.

## Input / output format

**Input**: Graph-structured network traffic data where nodes represent hosts/flows and edges represent connections, with features derived from network packet headers and flow statistics.

**Output**: Class label indicating the type of network traffic (e.g., normal, probe, denial-of-service, user-to-root, etc.)

## Scoring recipe

```python
def compute_accuracy(y_true, y_pred):
    correct = sum(1 for t, p in zip(y_true, y_pred) if t == p)
    return correct / len(y_true)
```

## Common pitfalls

- Severe class imbalance can skew accuracy; F1-score or macro-averaged metrics are often more informative.
- Graph sparsity and structural noise from augmentation can disproportionately degrade performance on imbalanced datasets.
- Fixed sample sizes (e.g., 5000) may not reflect full dataset distribution or real-world traffic volume.

## Evidence (verbatim from paper)

> Without augmentation, it achieved top-tier results on KDD CUP 99 (accuracy: 0.9921, F1: 0.9012), NSL-KDD (accuracy: 0.9870, F1: 0.9836), and tied for the highest score on CICIDS2017 (accuracy: 0.9850, F1: 0.9459).

## Citation

```bibtex
@misc{jahin2025cagn_gat_fusion,
  title={CAGN-GAT Fusion: A Hybrid Contrastive Attentive Graph Neural Network for Network Intrusion Detection},
  author={Md Abrar Jahin et al. (2025)},
  year={2025},
  note={arXiv:2503.00961}
}
```

- arXiv: 2503.00961