Code and artifacts for: Mapping the Aggregate–Worst-Class Trade-off in Feature Selection for Multi-Attack IoT Intrusion Detection: A Bi-Objective Evolutionary Study on TON_IoT, with an Identifier-Shortcut Ablation

Description

This repository contains the code that reproduces every table and figure in the paper, plus the fixed data split used (splits.json). The two datasets are not redistributed here (see licensing note below); download them from their original sources using the links and checksums provided. Every number in the paper is produced by the code above from the real datasets; nothing is hand-entered. Where a claimed effect was not statistically reliable (e.g. the wrapper's rare-class advantage under corrected testing), the code reports it as such.

Steps to reproduce

ENVIRONMENT. Python 3.12. Install with: pip install -r requirements.txt (numpy 2.4.4, pandas 3.0.2, scikit-learn 1.8.0, scipy 1.17.1, matplotlib 3.10.8, imbalanced-learn 0.14.2, joblib 1.5.3). A single CPU with ~4 GB RAM suffices; the full pipeline runs in a few minutes. All randomness uses a fixed seed (42), so results are deterministic. DATASETS (download separately; not redistributed here). Create a data/ folder and place: data/ton/Ton_IoT.csv (TON_IoT Network training partition, md5 e9c9e8a9c8595dcf85ae88fa12b838c2); data/nslkdd/KDDTrain+.csv (md5 8e1ddf4f9555080ee5f7af685ba27907); data/nslkdd/KDDTest+.csv (md5 75f88adea793cfef2d3db83f96aa5dea). Verify each with md5sum before running. SETUP. Create the cache folder and place the provided fixed split: mkdir -p artifacts && cp splits.json artifacts/splits.json TON_IoT PIPELINE (run in order): python3 preprocess.py — build the cleaned feature matrix. python3 nsga.py — run the self-coded NSGA-II; produces the Pareto front. python3 eval_test.py — full-feature baseline, mutual-information filter, Pareto subsets on the held-out test split. python3 cv_ablation.py — repeated 5x2 cross-validation and the destination-port shortcut ablation. python3 exp1_rareclass.py — imbalance remedies (class weighting, SMOTE, undersampling). python3 exp2_randomsubset.py — matched-size random-subset control. python3 exp3_seeds_clf.py — RF-seed variance and Extra-Trees / HistGradientBoosting sensitivity. python3 exp4_stats.py — Nadeau-Bengio corrected t-test, bootstrap CI, Wilcoxon test. python3 exp5_eff_conf.py — inference latency, model size, feature-cost tiers, confusion matrix. python3 nested_cv.py — leakage-free nested cross-validation. python3 run_seed.py 42, then 7, 13, 99, 123; then python3 stability_analyze.py — feature-selection stability (Nogueira index, Jaccard, selection frequency). FIGURES: python3 make_figures2.py then python3 regen_fig.py (vector PDFs to ./figures/). NSL-KDD EXTERNAL VALIDATION: python3 nsl_prep_baseline.py; python3 nsl_experiments.py; then python3 nsl_rep_chunk.py 0 2; python3 nsl_rep_chunk.py 2 4; python3 nsl_rep_chunk.py 4 6. Each script reads/writes cached artifacts under ./artifacts/. Every table and figure in the paper is produced by these steps; no values are hand-entered. See README.md for full details.

Institutions

• Petra University

  Amman, Amman

Categories

Licence