PLOTS.md

Experimental Result Plots

Omit Attacks Experiment

Relative recall change	RF	SVM	BLSTM
Omit attacks
Omit categories

Absolute recall	RF	SVM	BLSTM
Omit attacks
Omit categories

The first heatmap shows changes in recall relative to the baseline ((baseline - value) / baseline). The color scheme is logarithmic which means that small values already have very saturated colors. The second heatmap shows absolut recall values and has a linear color scale. This corresponds to the plot from our publication.

Both have the omitted attack class on the y-axis and the attack class for which the recall value is calculated on the x-axis. Therefore, one row represents the results from one trained IDS. The baseline corresponds to the IDS trained on a standard 80/20 train/test split.

Global metrics
Accuracy
Precision
Recall
F1

The metrics plot shows global metrics as achieved by the IIDS on the whole test set (which contains packets from all types of attacks as well as non-malicious packets).

Single Attack Experiment

Absolute recall	RF	SVM	BLSTM
Single attacks
Single categories

The heatmap shows the absolute recall values achieved by the IDSs. It has the attack class which the IDS was trained on on the y-axis and the attack class for which the recall value is achieved on the x-axis. Therefore, one row represents the results from one trained IDS.

Global metrics	Global Metrics
Accuracy
Precision
Recall
F1

The metrics plot shows global metrics as achieved by the IDS on the whole test set (which contains packets from all types of attacks as well as non-malicious packets).