Work

IP Composition Analysis as a Prerequisite for IDS Dataset Evaluation: Correcting File-Level Label Artifacts in SDN-MG25

Year: 2026

Type: article

Abstract: Intrusion detection system (IDS) research relies on accurately labeled network traffic datasets; however, label quality in IDS datasets is seldom audited prior to modeling. Many publicly available IDS datasets assign ground-truth labels based on capture filenames or temporal session windows rather than per-flow inspection, a practice referred to as file-level labeling. This study identifies and corrects a systematic mislabeling instance in SDN-MG25, a CICFlowMeter-based dataset for software-defined networking (SDN)-enabled microgrid intrusion detection. IP composition analysis, which cross-references each attack-labeled flow with the documented attacker IP address, reveals that the BackgroundAttackTraffic (BAT) class, comprising 3167 flows (79.5% of all attack labels), contains no attacker-originated traffic. All BAT flows involve legitimate microgrid hosts communicating with external services during the attack capture window. Correcting this labeling error increases binary detection F1 from 0.578 to 0.956±0.005, an improvement of +0.378 that is 4.2 times greater than the best single modeling improvement (threshold tuning, +0.090). Furthermore, Confident Learning, a state-of-the-art automated label-noise detector, recovers only 8.4% of mislabeled BAT flows (recall =0.084, precision =0.247), indicating that domain-knowledge audits are essential for detecting systematic, class-level mislabeling that statistical methods cannot identify. The end-to-end pipeline Macro F1 improves from 0.749 to 0.862 after label correction. IP composition analysis is proposed as a mandatory prerequisite for IDS dataset evaluation, and a reproducible two-stage pipeline with feature-tier ablation for session confound diagnosis is provided.

Source: Applied Sciences

DOI: 10.3390/app16105064

Authors: Khaled Chahine, Hassan N. Noura

Institutions: American University of the Middle East, Centre National de la Recherche Scientifique, Franche-Comté Électronique Mécanique Thermique et Optique - Sciences et Technologies, Université Marie et Louis Pasteur, American University of Beirut

Language: English

Topic: Network Security and Intrusion Detection

Subfield: Computer Networks and Communications

Field: Computer Science

Domain: Physical Sciences

Open Access status: gold

Estimated APC paid: $2,896

OpenAlex ID: W7161643343

FWCI:

Cites:

Cited by:

Related to: