Network Intrusion Detection

Problem

Network intrusion classifiers often look accurate on paper while missing the rare, high-impact attacks that matter most.

Solution

Binary and 5-way attack classifiers on the real NSL-KDD benchmark, with transparent analysis of exactly where accuracy metrics mislead — verified through CI.

Overview

An intrusion classifier that looks 99% accurate can still be missing the 1% of traffic that represents the handful of attacks that actually matter — accuracy alone is a misleading metric on imbalanced security data.

How it works

Both binary (attack vs. normal) and 5-way (attack-type) classifiers are trained on the real NSL-KDD benchmark, with an explicit breakdown of precision and recall per class rather than a single headline accuracy figure — showing transparently where the model is strong and where it still misses rare attack types. The full pipeline runs through GitHub Actions CI so results are reproducible on every change.

Result

An honest account of detection performance, including its blind spots, verified automatically rather than reported once and left untested.

Further reading

For more on why accuracy alone misleads on imbalanced data, see Imbalanced Datasets in Machine Learning: A Practical Guide.