Kdd99 Accuracy Eval

---
name: kdd99-accuracy-eval
description: Evaluates a network intrusion detection system's ability to classify TCP/IP connections as either normal or one of several attack types based on 41 network features. It measures how well the model discriminates between benign traffic and specific intrusion categories such as DoS, Probe, R2L, and U2R. Use when the user wants to benchmark on KDD-Cup 99, or asks about evaluating this task. Reports accuracy.
metadata:
  skill_kind: dataset_eval
  source_arxiv: 1405.1404
  bibtex_key: soliman2014quantum
  confidence: high
---

# kdd99-accuracy-eval

> A Network Intrusions Detection System based on a Quantum Bio Inspired Algorithm — Soliman et al. (2014) (arXiv:1405.1404, 2014)

## What this evaluates

Evaluates a network intrusion detection system's ability to classify TCP/IP connections as either normal or one of several attack types based on 41 network features. It measures how well the model discriminates between benign traffic and specific intrusion categories such as DoS, Probe, R2L, and U2R.

## Datasets

- **KDD-Cup 99** — total ?; splits: train (-1), test (-1)

## Metrics

- `accuracy` **(primary)** — range: [0, 1]
  - Calculated as (TP + TN) / (TP + FP + FN + TN), representing the proportion of correctly classified connections out of the total.

## Input / output format

**Input**: 41 qualitative and quantitative features representing a single TCP/IP connection.

**Output**: Classification label indicating whether the connection is 'normal' or belongs to one of the four attack categories (DoS, Probe, R2L, U2R).

## Scoring recipe

```python
tp = sum(1 for p, g in zip(preds, gold) if p == 'attack' and g == 'attack')
tn = sum(1 for p, g in zip(preds, gold) if p == 'normal' and g == 'normal')
fp = sum(1 for p, g in zip(preds, gold) if p == 'attack' and g == 'normal')
fn = sum(1 for p, g in zip(preds, gold) if p == 'normal' and g == 'attack')
accuracy = (tp + tn) / (tp + fp + fn + tn)
```

## Common pitfalls

- The evaluation uses a specific subset of 4000 records from KDD99 rather than the full dataset, which limits direct comparison with standard KDD99 benchmarks.
- The paper reports only overall accuracy and does not provide per-class precision, recall, or false alarm rates, making it difficult to assess performance on rare attack types like U2R.
- The 10-fold cross-validation uses a 90/10 train/test split per fold, which differs from the more common 80/20 or 70/30 splits used in later KDD99 studies.

## Evidence (verbatim from paper)

> The experiments were implemented over the The KDD-Cup 99 (Knowledge Discovery and Data Mining Tools Conference), a benchmark dataset for the netwrok intrusion detection systems [1]. ... A set of 4000 records is selected from the KDD based on the selected features of the PSO-WLS work to evaluate the performance of the QVICA- with EDA. The 10-fold cross validation method is applied where the data are distributed as 10 for testing and the remaining 90 for training. Classification accuracy is the evaluation measure used in this work. ... accuracy = (TP + TN) / (TP + FP + FN + TN)

## Citation

```bibtex
@misc{soliman2014quantum,
  title={A Network Intrusions Detection System based on a Quantum Bio Inspired Algorithm},
  author={Soliman et al. (2014)},
  year={2014},
  note={arXiv:1405.1404}
}
```

- arXiv: 1405.1404