Skip to content

IDSLab 0.3.0

Choose a tag to compare

View all tags
@hashtagRR hashtagRR released this 17 Oct 11:49
· 7 commits to main since this release
v0.3.0
ef49332

IDSLab is an open-source framework for building and evaluating staged (cascade) network intrusion
detection systems. A design is described as a graph: the stages (binary classifiers, anomaly
detectors and attack-type classifiers), the model in each stage, its decision rule, and the routes
that carry flows between stages. IDSLab fits the design under a fixed protocol and reports what
each stage adds.

Protocol

  • Data is split per seed into FIT, CAL, VAL and TEST. Every model, threshold and on/off choice is
    made on VAL, and TEST is read once, after the cascade is frozen.
  • The cascade is compared with controls built from its own fitted first stage: at the cascade's
    choices, at its best validation cutoff, and at the cascade's alarm budget. A paired bootstrap per
    run gives the uncertainty.
  • Results also include the effect of removing each stage, the path of every test flow, and the
    frontier gap. This compares the cascade's detection rate with the best the first stage can reach
    at the same false-alarm rate by changing its threshold.
  • Held-out attack families and attack types seen only in TEST measure detection of unseen attacks.
  • Models can come from scikit-learn style libraries, XGBoost, LightGBM, PyOD, PyTorch, custom
    adapters, or score files produced elsewhere.

This version

Version 0.3.0 rebuilds the local web dashboard around experiments: a config file together with
the results written under its name.

  • Experiments home: each design is listed with its state and the next step. Results are matched
    to their config by name and stored fingerprints, never by guesswork.
  • Guided setup: Data, Cascade, Evaluation, and Review & run, sharing one draft with a YAML view
    that keeps hand-written comments.
  • Visual builder: routing by drag, click or keyboard. Missing routes, loops and unreached
    stages are shown while the design stays editable.
  • Results page: reads the cascade against its first stage with the per-run bootstrap, in
    percentage points or as a cost. A small positive mean is not reported as an improvement.
  • Jobs page: progress taken from the run's own log, and past activity read from the
    workspace files.

The evaluation is unchanged from 0.2.0: the same config and data give the same per-flow
predictions, frozen configurations and controls. Because the version is part of each run's
fingerprint, results produced with 0.2.0 are computed again once under 0.3.0.

Use

Python 3.10 or newer. Install from the tagged source:

pip install git+https://github.com/hashtagRR/IDSLab.git@v0.3.0
idslab example demo
idslab run demo/r1_router_gate.yaml --out demo/runs
idslab dashboard --workspace demo --open

The example writes a small synthetic flow dataset and three reference designs. Its results
demonstrate the method; they are not findings about real network traffic. IDSLab is a research
tool for evaluating designs, not a network sensor.

Licence: GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later).

Assets 4
Loading