{"url":"/sota/network-intrusion-detection-on-cicids2017","task":{"name":"Network Intrusion Detection","url":"/task/network-intrusion-detection","note":null},"dataset":{"name":"CICIDS2017","url":"/dataset/cicids2017"},"category":"Natural Language Processing","categories":["Miscellaneous","Natural Language Processing"],"category_note":null,"description":"**Network intrusion detection** is the task of monitoring network traffic to and from all devices on a network in order to detect computer attacks.","description_from":"task","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","rank":"the archive's row order at snapshot; not re-ranked","rows_end_at":"2025-07-28","rows_withheld_as_spam":0,"metric_values":"the archive's strings, untouched"},"metrics":["Avg F1","Precision","Recall"],"metric_direction":{"note":"inferred from the metric name only (the archive records no direction); null = not inferred, chart draws points only","by_metric":{"Avg F1":"higher","Precision":"higher","Recall":"higher"}},"counts":{"rows":5,"rows_with_code":5,"rows_with_paper_page":5,"rows_dated":5,"rows_using_additional_data":2},"rows":[{"rank_in_archive_order":1,"model":"OC-SVM / RF","metrics":{"Avg F1":"0.9875","Precision":"99.26","Recall":"98.34"},"uses_additional_data":false,"paper_date":"2023-03-21","paper":"/paper/a-novel-multi-stage-approach-for-hierarchical","paper_url":"https://ieeexplore.ieee.org/document/10077796","paper_title":"A Novel Multi-Stage Approach for Hierarchical Intrusion Detection","code":"https://gitlab.ilabt.imec.be/mverkerk/multi-stage-hierarchical-ids","n_code_links":1,"syntology":null},{"rank_in_archive_order":2,"model":"Random Forest","metrics":{"Avg F1":"0.971","Precision":"98.2","Recall":"96.1"},"uses_additional_data":true,"paper_date":"2020-01-01","paper":"/paper/synthesis-of-a-machine-learning-model-for","paper_url":"https://www.researchgate.net/publication/347631637_Synthesis_of_a_Machine_Learning_Model_for_Detecting_Computer_Attacks_Based_on_the_CICIDS2017_Dataset","paper_title":"Synthesis of a Machine Learning Model for Detecting Computer Attacks Based on the CICIDS2017 Dataset","code":"https://github.com/jackaduma/NLP4CyberSecurity","n_code_links":2,"syntology":null},{"rank_in_archive_order":3,"model":"DBN","metrics":{"Avg F1":"0.94","Precision":"88.7","Recall":"99.7"},"uses_additional_data":false,"paper_date":"2022-07-05","paper":"/paper/an-intrusion-detection-system-based-on-deep","paper_url":"https://arxiv.org/abs/2207.02117v1","paper_title":"An Intrusion Detection System based on Deep Belief Networks","code":"https://github.com/othmbela/dbn-based-nids","n_code_links":1,"syntology":null},{"rank_in_archive_order":4,"model":"CNN-BiLSTM","metrics":{"Avg F1":"0.908","Precision":"95.9","Recall":"86.2"},"uses_additional_data":true,"paper_date":"2024-01-13","paper":"/paper/deep-learning-applications-for-intrusion","paper_url":"https://www.researchgate.net/publication/377458356_Deep_Learning_Applications_for_Intrusion_Detection_in_Network_Traffic","paper_title":"Deep Learning Applications for Intrusion Detection in Network Traffic","code":"https://github.com/fisher85/ml-cybersecurity/tree/master/python-web-attack-detection","n_code_links":1,"syntology":null},{"rank_in_archive_order":5,"model":"MLP","metrics":{"Avg F1":"0.873","Precision":"81.7","Recall":"99.5"},"uses_additional_data":false,"paper_date":"2022-07-05","paper":"/paper/an-intrusion-detection-system-based-on-deep","paper_url":"https://arxiv.org/abs/2207.02117v1","paper_title":"An Intrusion Detection System based on Deep Belief Networks","code":"https://github.com/othmbela/dbn-based-nids","n_code_links":1,"syntology":null}],"since_archive":{"claim":"Results that newer papers report for their own method, placed here by Syntology. A model pointed at the cell in the paper's own table; the number was read from that cell and checked against this leaderboard's metric, dataset, split and scale; an independent check that saw this leaderboard's other rows and every other leaderboard on the same dataset accepted it. Not reviewed by the paper's authors or by the archive's editors, and not ranked against the archive rows.","extraction_file_present":true,"measurement":{"test_papers":883,"papers_with_output":881,"judged_true":108,"judged":110,"wilson95_lower":0.9361,"measured_on":"2026-09-24","frozen_commit":"0e3de0df94"},"measurement_note":"blind adjudication of accepted entries on a held-out split of archive papers, rules frozen before the test","coverage":{"sentence":"Syntology has checked 6,885 of the 9,623 papers on this site that are newer than the archive; results from the others appear after they are checked.","complete":false,"papers_newer_than_archive":9623,"papers_checked":6885,"papers_extracted_not_yet_verified":0,"boards_without_verdict":2,"papers_not_yet_extracted":2737},"order":"newest first by month (arXiv date, else the arXiv-id month), then arXiv id descending","columns":[],"entries":[]},"syntology":{"read_at":"2026-09-25T09:33:49+00:00","claim":"Per row: N of M harvested code samples from that row's paper executed on a synthesized fixture; the other M-N are unverified. Not a reproduction of the row's number; not a correctness claim. n_pointer_only_licence counts samples the site points at rather than redistributes (a licence axis, independent of ran/unverified).","rows_with_graph_line":0,"rows_with_any_sample_ran":0,"distinct_papers_with_graph_line":0,"distinct_papers_with_any_sample_ran":0,"samples_over_distinct_papers":{"n_ran":0,"n_unverified":0,"n_samples":0,"n_pointer_only_licence":0,"note":"each paper (arXiv id) counted once, however many rows it is behind; this is the page-level figure"},"samples_row_weighted":{"n_ran":0,"n_unverified":0,"n_samples":0,"n_pointer_only_licence":0,"note":"row-weighted: a paper behind several rows is counted once per row; inflated relative to samples_over_distinct_papers by design, kept for readers summing the per-row syntology blocks"}}}