mkdir -p ~/.kaggle
python3 -c "import json;print(json.load(open('kaggle.json'))['key'],end='')" > ~/.kaggle/access_token
chmod 600 ~/.kaggle/access_token

%matplotlib inline
import time, warnings; warnings.filterwarnings('ignore')   # keep output clean
import numpy as np, pandas as pd                            # numerics + dataframes
import matplotlib.pyplot as plt                             # static plots (embed in HTML+PDF)
plt.rcParams['figure.dpi'] = 120                            # crisp figures
RANDOM_STATE = 0                                            # single seed used everywhere
np.random.seed(RANDOM_STATE)                                # reproducible sampling
NEG_WORD, POS_WORD = 'benign', 'attack'                      # class names (overridden by some loaders)

import os, glob
from sklearn.model_selection import train_test_split as _tts
# Four corpora, ONE schema. Sarhan et al. re-featured four different intrusion datasets into the
# same 43-field NetFlow v2 layout. That is what makes train-on-one / test-on-another possible:
# the columns line up, so the only thing that changes between train and test is the capture.
os.environ.setdefault('KAGGLE_KEY', open(os.path.expanduser('~/.kaggle/access_token')).read().strip())
SETS = {'BoT-IoT': 'dhoogla/nfbotiotv2', 'ToN-IoT': 'dhoogla/nftoniotv2',
        'UNSW-NB15': 'dhoogla/nfunswnb15v2', 'CSE-CIC-IDS2018': 'dhoogla/nfcsecicids2018v2'}
PER_SET = 400_000                      # stratified sample per corpus, so none dominates
import kaggle
frames = {}
for name, ref in SETS.items():
    dest = '/tmp/kg_' + ref.split('/')[-1]
    if not glob.glob(dest + '/**/*.parquet', recursive=True):
        kaggle.api.authenticate()
        print(f'downloading {name} (one-time)...')
        kaggle.api.dataset_download_files(ref, path=dest, unzip=True, quiet=True)
    f = sorted(glob.glob(dest + '/**/*.parquet', recursive=True), key=os.path.getsize, reverse=True)[0]
    d = pd.read_parquet(f)
    d.columns = [str(c).strip() for c in d.columns]
    if len(d) > PER_SET:               # stratified, so each corpus keeps its own attack rate
        d, _ = _tts(d, train_size=PER_SET, random_state=0, stratify=d['Label'])
    frames[name] = d.reset_index(drop=True)
    print(f'{name:18} {len(d):>8,} rows | attack rate ' + f'{d["Label"].mean():.4f}')
# One shared feature list serves every corpus, because the schema is identical.
DROPCOLS = ['Label', 'Attack', 'Dataset']
feat = [c for c in frames['UNSW-NB15'].columns if c not in DROPCOLS]
def _prep(d):
    Xa = d[feat].apply(pd.to_numeric, errors='coerce')
    Xa = Xa.replace([np.inf, -np.inf], np.nan).fillna(0.0).clip(-1e15, 1e15)
    return Xa, d['Label'].astype(int).to_numpy()
PREP = {k: _prep(v) for k, v in frames.items()}      # used by the transfer matrix below
# df / X / y / family exist so the shared EDA and audit cells still run. 'family' is the SOURCE
# CORPUS, so the per-group recall plot reads as per-corpus recall on the pooled split.
df = pd.concat([v.assign(corpus=k) for k, v in frames.items()], ignore_index=True)
df['y'] = df['Label'].astype(int)
df['family'] = df['corpus']
X = df[feat].apply(pd.to_numeric, errors='coerce')
X = X.replace([np.inf, -np.inf], np.nan).fillna(0.0).clip(-1e15, 1e15)
X = X.loc[:, X.nunique() > 1]; feat = list(X.columns)
y = df['y'].to_numpy(); family = df['family'].to_numpy()
assert len(df) >= 1_000_000, f'floor not met: {len(df):,}'
print(f'pooled {len(df):,} flows x {len(feat)} shared features across {len(frames)} corpora')

BoT-IoT             400,000 rows | attack rate 0.9957

ToN-IoT             400,000 rows | attack rate 0.7258

UNSW-NB15           400,000 rows | attack rate 0.0378

CSE-CIC-IDS2018     400,000 rows | attack rate 0.1184

pooled 1,600,000 flows x 41 shared features across 4 corpora

# --- EDA 1: class balance and the attack-family mix ---
fig, ax = plt.subplots(1, 2, figsize=(11, 4))
df['y'].map({0:NEG_WORD,1:POS_WORD}).value_counts().plot.bar(               # counts per class
    ax=ax[0], color=['#2a9d8f','#e76f51']); ax[0].set_yscale('log')
ax[0].set_title(f'Class balance ({NEG_WORD} vs {POS_WORD})'); ax[0].set_ylabel('records (log)')
df.loc[df.y==1,'family'].value_counts().head(8).plot.barh(                  # top attack families
    ax=ax[1], color='#e76f51'); ax[1].invert_yaxis(); ax[1].set_title('Top attack families')
plt.tight_layout(); plt.show()

# --- EDA 2: feature correlation + a 2-D PCA projection ---
from sklearn.preprocessing import StandardScaler                 # scale before PCA
from sklearn.decomposition import PCA
fig, ax = plt.subplots(1, 2, figsize=(12, 5))
topv = X[feat].var().sort_values().tail(12).index                # 12 highest-variance features
im = ax[0].imshow(X[topv].corr(), cmap='coolwarm', vmin=-1, vmax=1)  # correlation heatmap
ax[0].set_xticks(range(len(topv))); ax[0].set_xticklabels(topv, rotation=90, fontsize=7)
ax[0].set_yticks(range(len(topv))); ax[0].set_yticklabels(topv, fontsize=7)
ax[0].set_title('Feature correlation (top-variance)'); fig.colorbar(im, ax=ax[0], shrink=0.7)
samp = X.sample(min(5000, len(X)), random_state=RANDOM_STATE)     # subsample for a fast PCA
pc = PCA(n_components=2).fit_transform(StandardScaler().fit_transform(samp))
ys = y[samp.index]                                               # aligned labels for coloring
for lab,c in [(0,'#2a9d8f'),(1,'#e76f51')]:
    ax[1].scatter(pc[ys==lab,0], pc[ys==lab,1], s=4, alpha=0.4, color=c,
                  label={0:NEG_WORD,1:POS_WORD}[lab])
ax[1].set_title('PCA projection (2 components)'); ax[1].legend(); ax[1].set_xlabel('PC1'); ax[1].set_ylabel('PC2')
plt.tight_layout(); plt.show()

# --- Model comparison: four learners on the same held-out split ---
from sklearn.model_selection import train_test_split
from sklearn.linear_model import LogisticRegression
from sklearn.ensemble import RandomForestClassifier
from sklearn.metrics import accuracy_score, roc_auc_score
import xgboost as xgb, lightgbm as lgb

# Stratified split keeps the class ratio in both halves.
Xtr, Xte, ytr, yte = train_test_split(X, y, test_size=0.25, random_state=RANDOM_STATE, stratify=y)
from sklearn.pipeline import make_pipeline
from sklearn.preprocessing import StandardScaler
N_MATERIALIZED = len(y)                                          # the full corpus we loaded (see printed count)
# HONEST DISCLOSURE: we do NOT train on all N. We fit on a STRATIFIED subsample (<=120k) because
# these learners saturate long before then on this data. Every headline below is a SUBSAMPLE
# number, not a full-corpus number — saying otherwise would be the fabrication this course forbids.
if len(Xtr) > 120_000:
    Xtr, _, ytr, _ = train_test_split(Xtr, ytr, train_size=120_000, random_state=RANDOM_STATE,
                                      stratify=ytr)               # genuinely stratified, not random
MAJORITY_BASELINE = max(np.mean(yte), 1 - np.mean(yte))          # accuracy of 'always predict majority'
print(f'materialized {N_MATERIALIZED:,} rows | trained on {len(Xtr):,} (stratified subsample) | '
      f'held-out {len(yte):,}')
print(f'MAJORITY-CLASS BASELINE accuracy = {MAJORITY_BASELINE:.4f}  '
      f'(any model must beat THIS, not 0.5, to be interesting)')

models = {                                                        # four standard, diverse learners
    'LogisticRegression': make_pipeline(StandardScaler(), LogisticRegression(max_iter=300)),  # scaled!
    'RandomForest': RandomForestClassifier(n_estimators=60, n_jobs=-1, random_state=RANDOM_STATE),
    'XGBoost': xgb.XGBClassifier(n_estimators=80, max_depth=6, tree_method='hist', n_jobs=-1,
                                 eval_metric='logloss', random_state=RANDOM_STATE),
    'LightGBM': lgb.LGBMClassifier(n_estimators=80, n_jobs=-1, verbose=-1, random_state=RANDOM_STATE),
}
rows, fitted = [], {}
for name, m in models.items():                                    # fit + score each model
    t = time.perf_counter(); m.fit(Xtr, ytr); fitted[name] = m
    p = m.predict_proba(Xte)[:, 1]                                # positive-class probability on held-out
    rows.append({'model': name, 'accuracy': round(accuracy_score(yte, (p>0.5).astype(int)), 6),
                 'roc_auc': round(roc_auc_score(yte, p), 6),      # 6 dp: a 1.000000 is a red flag, not a win
                 'train_s': round(time.perf_counter()-t, 1)})
rows.append({'model': 'MajorityBaseline', 'accuracy': round(MAJORITY_BASELINE, 4),
             'roc_auc': 0.5, 'train_s': 0.0})            # show the baseline IN the ranking table
comparison = pd.DataFrame(rows).sort_values('roc_auc', ascending=False).reset_index(drop=True)
_ranked = comparison[comparison.model != 'MajorityBaseline']
best_name = _ranked.iloc[0]['model']; best = fitted[best_name]  # winner by ROC-AUC (excl. baseline)
print('best model:', best_name); comparison

materialized 1,600,000 rows | trained on 120,000 (stratified subsample) | held-out 400,000
MAJORITY-CLASS BASELINE accuracy = 0.5306  (any model must beat THIS, not 0.5, to be interesting)

best model: XGBoost

# --- Results for the best model: confusion, ROC, PR, importances, per-family recall ---
from sklearn.metrics import confusion_matrix, roc_curve, precision_recall_curve, recall_score
pb = best.predict_proba(Xte)[:, 1]; pred = (pb > 0.5).astype(int)
fig, ax = plt.subplots(1, 3, figsize=(15, 4))
# (1) confusion matrix
cm = confusion_matrix(yte, pred); ax[0].imshow(cm, cmap='Blues')
ax[0].set_title(f'{best_name}: confusion'); ax[0].set_xticks([0,1]); ax[0].set_yticks([0,1])
ax[0].set_xticklabels([NEG_WORD,POS_WORD]); ax[0].set_yticklabels([NEG_WORD,POS_WORD])
for (i,j),v in np.ndenumerate(cm): ax[0].text(j,i,f'{v:,}',ha='center',va='center')
# (2) ROC and PR curves
fpr,tpr,_ = roc_curve(yte, pb); prec,rec,_ = precision_recall_curve(yte, pb)
ax[1].plot(fpr,tpr,color='#264653'); ax[1].plot([0,1],[0,1],'--',c='grey')
ax[1].set_title(f'ROC (AUC={roc_auc_score(yte,pb):.4f})'); ax[1].set_xlabel('FPR'); ax[1].set_ylabel('TPR')
ax[2].plot(rec,prec,color='#e76f51'); ax[2].set_title('Precision-Recall'); ax[2].set_xlabel('recall'); ax[2].set_ylabel('precision')
plt.tight_layout(); plt.show()

# (3) feature importances + (4) per-attack-family recall
fig, ax = plt.subplots(1, 2, figsize=(13, 5))
imp, names = None, feat                                           # importances, robust to the scaled-LR pipeline
if hasattr(best, 'feature_importances_'):                          # tree models
    imp = best.feature_importances_; names = list(getattr(best, 'feature_names_in_', feat))[:len(imp)]
elif hasattr(best, 'named_steps') and 'logisticregression' in getattr(best, 'named_steps', {}):
    imp = np.abs(best.named_steps['logisticregression'].coef_[0]); names = feat  # LR pipeline
elif hasattr(best, 'coef_'):
    imp = np.abs(best.coef_[0]); names = feat
if imp is not None:
    pd.Series(imp, index=names[:len(imp)]).sort_values().tail(12).plot.barh(ax=ax[0], color='#264653')
ax[0].set_title(f'{best_name}: top importances / |coef|')
# Per-family recall, WORST-first so rare, hard classes are visible, not just the dominant floods.
fam_te = df.loc[Xte.index, 'family']
fr = {}
for fam, cnt in fam_te[yte==1].value_counts().items():
    if cnt < 5: continue                                          # need a few positives for a meaningful recall
    mask = (fam_te==fam).to_numpy(); fr[fam] = recall_score(yte[mask], pred[mask], zero_division=0)
srt = pd.Series(fr).sort_values()
show = pd.concat([srt.head(9), srt.tail(3)]) if len(srt) > 12 else srt   # worst 9 + best 3
show = show[~show.index.duplicated()]
show.plot.barh(ax=ax[1], color=['#e76f51' if v < 0.5 else '#2a9d8f' for v in show]); ax[1].set_xlim(0,1)
ax[1].set_title('Per-family recall (worst first; red < 0.5)')
plt.tight_layout(); plt.show()
# Operational numbers, not just figures: false-positive rate and the worst per-family recalls.
tn, fp = int(cm[0,0]), int(cm[0,1])
fpr_op = fp/(fp+tn) if (fp+tn) > 0 else float('nan')             # benign wrongly flagged @0.5
print(f'operational FALSE-POSITIVE RATE @0.5 = {fpr_op:.4f}  ({fp:,} benign flagged of {fp+tn:,})')
print('worst per-family recalls:', {k: round(v, 3) for k, v in srt.head(6).items()})

operational FALSE-POSITIVE RATE @0.5 = 0.0065  (1,378 benign flagged of 212,223)
worst per-family recalls: {'CSE-CIC-IDS2018': 0.946, 'UNSW-NB15': 0.969, 'ToN-IoT': 0.99, 'BoT-IoT': 1.0}

# --- The transfer matrix: train on corpus i, test on corpus j ---
import xgboost as xgb
from sklearn.metrics import roc_auc_score
names = list(PREP)
TRAIN_N = 120_000                       # same subsample budget the other notebooks use
# Split EACH corpus ONCE, up front. A model is fitted only on its corpus's train half, and the
# diagonal is scored on that corpus's held-out half. Splitting after training would let training
# rows reappear in the diagonal's test set and inflate it, flattering the very comparison this
# notebook exists to make.
SPLIT = {}
for nm in names:
    Xa, ya = PREP[nm]
    Xtr_, Xte_, ytr_, yte_ = _tts(Xa, ya, test_size=0.25, random_state=RANDOM_STATE, stratify=ya)
    if len(Xtr_) > TRAIN_N:
        Xtr_, _, ytr_, _ = _tts(Xtr_, ytr_, train_size=TRAIN_N, random_state=RANDOM_STATE, stratify=ytr_)
    SPLIT[nm] = (Xtr_, ytr_, Xte_, yte_)
models = {}
for src in names:                       # one model per SOURCE corpus, fitted on its train half only
    Xtr_, ytr_, _, _ = SPLIT[src]
    m = xgb.XGBClassifier(n_estimators=120, max_depth=6, tree_method='hist', n_jobs=-1,
                          eval_metric='logloss', random_state=RANDOM_STATE)
    models[src] = m.fit(Xtr_, ytr_)
    print(f'fitted on {src} ({len(Xtr_):,} rows)')
M = pd.DataFrame(index=names, columns=names, dtype=float)
for src in names:
    for tgt in names:
        # diagonal: that corpus's own held-out half. off-diagonal: a corpus never trained on, so
        # every row of it is unseen by construction.
        Xe, ye = (SPLIT[tgt][2], SPLIT[tgt][3]) if src == tgt else PREP[tgt]
        p = models[src].predict_proba(Xe)[:, 1]
        M.loc[src, tgt] = roc_auc_score(ye, p)
diag = np.diag(M.to_numpy().astype(float))
off = M.to_numpy().astype(float)[~np.eye(len(names), dtype=bool)]
print(f'\nin-distribution (diagonal)  mean {diag.mean():.4f}   min {diag.min():.4f}')
print(f'cross-corpus (off-diagonal) mean {off.mean():.4f}   min {off.min():.4f}   '
      f'worse-than-random cells: {(off < 0.5).sum()} of {off.size}')
M.round(4)

fitted on BoT-IoT (120,000 rows)
fitted on ToN-IoT (120,000 rows)

fitted on UNSW-NB15 (120,000 rows)

fitted on CSE-CIC-IDS2018 (120,000 rows)

in-distribution (diagonal)  mean 0.9966   min 0.9880
cross-corpus (off-diagonal) mean 0.5434   min 0.3315   worse-than-random cells: 5 of 12

# --- Visualise the same matrix: bright diagonal, dim everywhere else ---
fig, ax = plt.subplots(1, 2, figsize=(13, 5))
Mv = M.to_numpy().astype(float)
im = ax[0].imshow(Mv, cmap='RdYlGn', vmin=0.3, vmax=1.0)
ax[0].set_xticks(range(len(names))); ax[0].set_xticklabels(names, rotation=35, ha='right', fontsize=8)
ax[0].set_yticks(range(len(names))); ax[0].set_yticklabels(names, fontsize=8)
ax[0].set_xlabel('tested on'); ax[0].set_ylabel('trained on')
ax[0].set_title('Transfer matrix (ROC-AUC)')
for i in range(len(names)):
    for j in range(len(names)):
        ax[0].text(j, i, f'{Mv[i,j]:.3f}', ha='center', va='center', fontsize=8,
                   color='black' if 0.45 < Mv[i,j] < 0.95 else 'white')
fig.colorbar(im, ax=ax[0], shrink=0.8)
ax[1].bar(['in-distribution\n(diagonal)', 'cross-corpus\n(off-diagonal)'],
          [diag.mean(), off.mean()], color=['#2a9d8f', '#e76f51'])
ax[1].axhline(0.5, ls='--', c='grey'); ax[1].set_ylim(0, 1.05)
ax[1].set_ylabel('mean ROC-AUC'); ax[1].set_title('The gap this notebook exists to show')
ax[1].text(1, 0.52, 'random guessing', fontsize=8, color='grey')
plt.tight_layout(); plt.show()

# --- Validity audit: is the score real detection, or a data shortcut? ---
from sklearn.metrics import roc_auc_score
samp = X.sample(min(60_000, len(X)), random_state=1); ysamp = y[samp.index]
aucs = {}
for c in feat:                                                    # AUC of EACH feature alone
    col = samp[c].to_numpy(float)
    if col.std()==0: continue
    a = roc_auc_score(ysamp, col); aucs[c] = max(a, 1-a)          # direction-agnostic
best_auc = max(aucs.values()); best_col = max(aucs, key=aucs.get)
dup_rate = 1 - X.drop_duplicates().shape[0]/len(X)               # exact-duplicate feature rows (whole set)
# The statistic that actually inflates a held-out score is TRAIN/TEST CONTAMINATION: how many test
# rows are exact duplicates of a training row. Measure it directly on the split used above.
_trkeys = set(map(tuple, np.round(Xtr.to_numpy(), 6)))
_te = np.round(Xte.to_numpy(), 6)[:50_000]
contam = float(np.mean([tuple(r) in _trkeys for r in _te]))      # fraction of test rows seen in train
# Trust grade reflects BOTH failure modes and takes the WORSE of the two: a near-perfect single
# feature (shortcut) OR heavy train/test contamination each independently invalidate the headline.
_ga = 'F' if best_auc>=0.999 else 'D' if best_auc>=0.99 else 'C' if best_auc>=0.95 else 'B' if best_auc>=0.85 else 'A'
_gc = 'F' if contam>=0.5 else 'D' if contam>=0.3 else 'C' if contam>=0.15 else 'B' if contam>=0.05 else 'A'
grade = max(_ga, _gc)                                            # 'max' letter = worse grade (A best, F worst)
print(f'best single-feature AUC = {best_auc:.4f}  (feature: {best_col})')
print(f'   note: a near-1.0 single-feature AUC means this feature is *near-sufficient* (a shortcut),\n'
      f'   which may be legitimate signal OR an artifact — it is NOT the same as target leakage.')
print(f'exact-duplicate row rate (whole corpus) = {dup_rate:.3f}')
print(f'TRAIN/TEST exact-row contamination       = {contam:.3f}  (single-feat grade {_ga}, contam grade {_gc})')
print(f'==> data trust grade: {grade}   (worse of the two; F = shortcut and/or heavy contamination)')
s = pd.Series(aucs).sort_values().tail(15)
fig, ax = plt.subplots(figsize=(8,5))
s.plot.barh(ax=ax, color=['#e76f51' if v>=0.99 else '#457b9d' for v in s]); ax.axvline(0.5,ls='--',c='grey')
ax.set_xlim(0.5,1.0); ax.set_title('Single-feature ROC-AUC (red = near-perfect shortcut)'); ax.set_xlabel('AUC alone')
plt.tight_layout(); plt.show()

best single-feature AUC = 0.8643  (feature: DST_TO_SRC_AVG_THROUGHPUT)
   note: a near-1.0 single-feature AUC means this feature is *near-sufficient* (a shortcut),
   which may be legitimate signal OR an artifact — it is NOT the same as target leakage.
exact-duplicate row rate (whole corpus) = 0.000
TRAIN/TEST exact-row contamination       = 0.000  (single-feat grade B, contam grade A)
==> data trust grade: B   (worse of the two; F = shortcut and/or heavy contamination)

# --- Ablation: SHOW the inflation empirically, don't just narrate it ---
from sklearn.base import clone
def _retrain_auc(Xa, ya):                                        # re-split, stratified-subsample, refit best family
    xtr, xte, ytr2, yte2 = train_test_split(Xa, ya, test_size=0.25, random_state=RANDOM_STATE, stratify=ya)
    if len(xtr) > 120_000:
        xtr, _, ytr2, _ = train_test_split(xtr, ytr2, train_size=120_000, random_state=RANDOM_STATE, stratify=ytr2)
    m = clone(best); m.fit(xtr, ytr2)
    return roc_auc_score(yte2, m.predict_proba(xte)[:, 1])
base_auc = roc_auc_score(yte, best.predict_proba(Xte)[:, 1])     # (0) the headline held-out AUC
Xdd = X.drop_duplicates(); ydd = y[Xdd.index]                    # (1) de-duplicated corpus
auc_dedup = _retrain_auc(Xdd, ydd)
auc_noshort = _retrain_auc(X.drop(columns=[best_col]), y) if best_col in X.columns else base_auc  # (2) drop shortcut
ablation = pd.DataFrame([
    {'setting': 'headline (as-is)',              'held_out_auc': round(base_auc, 6)},
    {'setting': f'de-duplicated ({1-len(Xdd)/len(X):.0%} rows removed)', 'held_out_auc': round(auc_dedup, 6)},
    {'setting': f'shortcut feature dropped ({best_col})', 'held_out_auc': round(auc_noshort, 6)},
])
print('Ablation — how much of the headline survives once each artifact is removed:')
ablation

Ablation — how much of the headline survives once each artifact is removed:

# --- Reproducibility & robustness ---
import sklearn
from sklearn.model_selection import StratifiedKFold, cross_val_score
print(f'seed={RANDOM_STATE} | numpy {np.__version__} | sklearn {sklearn.__version__} | '
      f'xgboost {xgb.__version__} | lightgbm {lgb.__version__}')
# 3-fold cross-validated ROC-AUC of the winning model (fresh clone, bounded subsample) -> mean +/- std.
from sklearn.base import clone
cvX, cvy = Xtr.iloc[:40_000], ytr[:40_000]
def _auc_scorer(est, Xv, yv):                                   # robust to xgboost's 2-col predict_proba
    p = est.predict_proba(Xv)
    p = p[:, 1] if getattr(p, 'ndim', 1) == 2 else p
    return roc_auc_score(yv, p)
try:
    cv = cross_val_score(clone(best), cvX, cvy,
                         cv=StratifiedKFold(3, shuffle=True, random_state=RANDOM_STATE),
                         scoring=_auc_scorer, error_score='raise')
    assert np.all(np.isfinite(cv)), 'non-finite CV folds'   # FAIL CLOSED: never narrate a NaN as evidence
    print(f'{best_name} 3-fold CV ROC-AUC = {cv.mean():.4f} +/- {cv.std():.4f}  '
          f'(mean +/- std across 3 stratified folds; a small std means a stable estimate on this split)')
except Exception as e:
    print(f'CV UNAVAILABLE ({type(e).__name__}: {str(e)[:60]}); rely on the single held-out AUC above — '
          f'we do NOT report a CV number we could not compute')

seed=0 | numpy 2.3.5 | sklearn 1.9.0 | xgboost 1.6.2 | lightgbm 4.7.0

XGBoost 3-fold CV ROC-AUC = 0.9988 +/- 0.0002  (mean +/- std across 3 stratified folds; a small std means a stable estimate on this split)

Reported approach	Known caveat
In-distribution NIDS benchmarks	near-perfect scores are routine and say little about transfer
Cross-dataset NIDS studies	report large drops; this notebook measures the drop directly

Property	Value
Source	Kaggle `dhoogla/nf{botiot,toniot,unswnb15,csecicids2018}v2`
Corpora	4, all on the same 43-field NetFlow v2 schema
Rows	400,000 stratified per corpus, 1.6M pooled
Label	`Label` 0/1; `family` is set to the source corpus
Access	Kaggle API token required, at `~/.kaggle/access_token` (see assignments/SETUP.md)

	model	accuracy	roc_auc	train_s
0	XGBoost	0.992857	0.999200	0.6
1	LightGBM	0.991378	0.999162	1.3
2	RandomForest	0.993635	0.998457	1.1
3	LogisticRegression	0.864070	0.945969	0.8
4	MajorityBaseline	0.530600	0.500000	0.0

	BoT-IoT	ToN-IoT	UNSW-NB15	CSE-CIC-IDS2018
BoT-IoT	0.9999	0.3315	0.6120	0.7862
ToN-IoT	0.4910	0.9990	0.3822	0.5468
UNSW-NB15	0.7879	0.3527	0.9995	0.3953
CSE-CIC-IDS2018	0.5814	0.6293	0.6243	0.9880

	setting	held_out_auc
0	headline (as-is)	0.999200
1	de-duplicated (0% rows removed)	0.999229
2	shortcut feature dropped (DST_TO_SRC_AVG_THROU...	0.999208

Goal of this notebook¶

What you will learn¶

Where this connects to the course text¶

Does It Transfer? Cross-Dataset Intrusion Detection on One Schema¶

Train on one corpus, test on another - the check the other 35 notebooks flag as missing¶

1. Research problem¶

2. Literature review¶

3. Dataset provenance & honesty caveats¶

Before you run this: getting the data¶

4. Solution design¶

5. Implementation architecture¶

6. Data acquisition & preparation¶

7. Exploratory data analysis¶

8. Model comparison¶

9. Results¶

9b. The transfer matrix¶

10. Validity audit — is the score real?¶

11. Ablation — does the headline survive removing the artifacts?¶

12. Reproducibility & robustness¶

13. Scientific conclusion¶

References¶