MAWIFlow基准：用于网络入侵检测的逼真流级评估
MAWIFlow Benchmark: Realistic Flow-Based Evaluation for Network Intrusion Detection
AI总结：
针对合成流量基准的缺陷，本文提出基于MAWILAB真实骨干流量的MAWIFlow基准，对比传统机器学习与CNN-BiLSTM模型，证明后者在时间漂移下泛化更优，并公开全部资源以促进可复现评估。
摘要：
网络入侵检测的基准数据集通常依赖于合成生成的流量，这无法反映实际运营环境中遇到的统计变异性和时间漂移。本文介绍了MAWIFlow，一个基于MAWILAB v1.1数据集衍生的流级基准，旨在实现对异常检测方法的逼真且可复现的评估。我们提出了一种可复现的预处理流程，将原始数据包捕获转换为符合CICFlowMeter格式的流表示，同时保留MAWILab的原始异常标签。生成的数据集包含2011年1月、2016年和2021年的时间上不同的样本，这些样本来自跨太平洋骨干流量。为了建立参考基线，我们将传统机器学习方法（包括决策树、随机森林、XGBoost和逻辑回归）与基于CNN-BiLSTM架构的深度学习模型进行了比较。实证结果表明，基于树的分类器在时间静态数据上表现良好，但随着时间的推移会出现显著的性能下降。相比之下，CNN-BiLSTM模型保持了更好的性能，从而表现出更好的泛化能力。这些发现强调了合成基准和静态模型的局限性，并促使采用具有明确时间结构的逼真数据集。所有数据集、流程代码和模型实现均已公开，以促进透明度和可复现性。
英文摘要：
Benchmark datasets for network intrusion detection commonly rely on synthetically generated traffic, which fails to reflect the statistical variability and temporal drift encountered in operational environments. This paper introduces MAWIFlow, a flow-based benchmark derived from the MAWILAB v1.1 dataset, designed to enable realistic and reproducible evaluation of anomaly detection methods. A reproducible preprocessing pipeline is presented that transforms raw packet captures into flow representations conforming to the CICFlowMeter format, while preserving MAWILab's original anomaly labels. The resulting datasets comprise temporally distinct samples from January 2011, 2016, and 2021, drawn from trans-Pacific backbone traffic. To establish reference baselines, traditional machine learning methods, including Decision Trees, Random Forests, XGBoost, and Logistic Regression, are compared to a deep learning model based on a CNN-BiLSTM architecture. Empirical results demonstrate that tree-based classifiers perform well on temporally static data but experience significant performance degradation over time. In contrast, the CNN-BiLSTM model maintains better performance, thus showing improved generalization. These findings underscore the limitations of synthetic benchmarks and static models, and motivate the adoption of realistic datasets with explicit temporal structure. All datasets, pipeline code, and model implementations are made publicly available to foster transparency and reproducibility.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
