Auditing Collection Artefacts in IoT Intrusion Detection Datasets

Abstract

Single-feature probing protocol and progressive ablation harness for auditing collection artefacts in network intrusion detection corpora. Reproduces every figure and table of the accompanying manuscript. Central result: in CICIoT2023, the feature Number, which records the size of the aggregation window used during feature extraction, separates benign from malicious traffic at 97.96% accuracy on a class-balanced test set, against 98.81% for all 39 features combined. The corpus contains no port, address, duration or timestamp, and is therefore compliant with the standing recommendation to exclude metadata features. Corpora are not redistributed here; they are obtained from their original distributors.