Publications on federated learning, intrusion detection, deep learning ensembles and explainable AI, read from a BibTeX file at build time.
Enhancing Generalization of Cross-Domain Intrusion Detection: A Heterogeneous Deep Stacked Ensemble Approach
Unveiling the Generalizability Gap: A Cross-Domain Evaluation of Machine Learning Algorithms for Network Intrusion Detection
Further down, this page also hosts a working piece from that research.
Interactive research piece
This is a real flow record from a held-out test set, scored live by the model above. Move a slider and watch the probability and the per-feature attribution bars update immediately, computed from the same weights, not a canned animation.
Toy logistic regression, trained offline on a balanced, 2,000-row subset of NSL-KDD (12 flow features). Not a production intrusion detector, and not claiming to be one.
Flagged: maliciousmodel confidence 99.8% (evades below 50%)
Shorter connections finish faster and move less traffic per attempt.
Smaller packets reduce bandwidth footprint but need more connections for the same effect.
A real SYN flood rarely gets a response anyway; this is already close to zero.
Fewer connections per window looks less like a flood, but is a weaker attack.
Same tradeoff as connection count, scoped to one service.
Same signature: this rate sitting near 1.0 is what makes it a SYN flood in the first place.
Spreading across services looks less targeted, but dilutes the flood.
Fewer hosts touched per window reduces blast radius and visibility.
Same tradeoff, scoped to host and service together.
A SYN flood's whole mechanism is half-open connections; turning this off means it stops being this attack.
Faking a successful login means actually compromising valid credentials, a separate problem from anything else in this flow record.
This identifies which service is being targeted. Changing it means attacking a different service, not evading detection on this one.
Minimal path to evade
The smallest realistic change that flips this: adjust 7 features, moving 2.75 units in the model's standardized feature space.
You changed 0 features, moving 0.00 units in the model's standardized feature space. The smallest realistic change that flips this: adjust 7 features, moving 2.75 units in the model's standardized feature space.
TODO(Q): write the real explanation here.
Data: NSL-KDD dataset. Cite: M. Tavallaee, E. Bagheri, W. Lu, A. Ghorbani, 'A Detailed Analysis of the KDD CUP 99 Data Set,' 2nd IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA), 2009. Original terms (unb.ca/cic/datasets/nsl.html) permit redistribution and mirroring in any form with this citation retained. Mirror: https://github.com/defcom17/NSL_KDD