Kddcup1999 Iot Eval

---
name: kddcup1999-iot-eval
description: Evaluates supervised machine learning classifiers for anomaly detection in IoT network traffic, specifically probing their ability to identify intrusion attack categories under severe class imbalance. Use when the user wants to benchmark on KDD Cup 1999, or asks about evaluating this task. Reports Accuracy.
metadata:
  skill_kind: dataset_eval
  source_arxiv: 2604.23332
  bibtex_key: basharat2026advanced
  confidence: high
---

# kddcup1999-iot-eval

> Advanced Anomaly Detection and Threat Intelligence in Zero Trust IoT Environments Using Machine Learning — Basharat et al. (2026) (arXiv:2604.23332, 2026)

## What this evaluates

Evaluates supervised machine learning classifiers for anomaly detection in IoT network traffic, specifically probing their ability to identify intrusion attack categories under severe class imbalance.

## Datasets

- **KDD Cup 1999** — total ?; splits: train (-1), test (-1)

## Metrics

- `Accuracy` **(primary)** — range: [0, 1]
  - Proportion of correctly classified instances out of the total number of instances.
- `weighted F1-score` — range: [0, 1]
  - Harmonic mean of precision and recall, averaged across all classes weighted by their support to handle class imbalance.

## Input / output format

**Input**: Tabular network traffic features representing connection records, with multi-class labels indicating normal traffic or specific attack types.

**Output**: Predicted class label for each network connection instance.

## Scoring recipe

```python
def compute_metrics(y_true, y_pred):
    accuracy = np.sum(y_true == y_pred) / len(y_true)
    f1 = f1_score(y_true, y_pred, average='weighted')
    return {'accuracy': accuracy, 'weighted_f1': f1}
```

## Common pitfalls

- Class imbalance can artificially inflate accuracy, making models appear effective while missing minority attack classes.
- Sequence models like RNNs perform poorly on this dataset because the features are static tabular records rather than temporal sequences.
- SMOTE improves minority-class detection but does not fully prevent overfitting in high-variance models like Decision Trees.

## Evidence (verbatim from paper)

> Performance was assessed using Accuracy and weighted F1-score to ensure balanced evaluation across attack categories.

## Citation

```bibtex
@misc{basharat2026advanced,
  title={Advanced Anomaly Detection and Threat Intelligence in Zero Trust IoT Environments Using Machine Learning},
  author={Basharat et al. (2026)},
  year={2026},
  note={arXiv:2604.23332}
}
```

- arXiv: 2604.23332