{"id":"https://openalex.org/W7225748015","doi":"https://doi.org/10.71426/jcdt.v2.i2.pp207-215","title":"A Leakage-Controlled Evaluation Protocol for Machine-Learning Intrusion Detection on the TON_IoT Network Dataset","display_name":"A Leakage-Controlled Evaluation Protocol for Machine-Learning Intrusion Detection on the TON_IoT Network Dataset","publication_year":2026,"publication_date":"2026-11-10","ids":{"openalex":"https://openalex.org/W7225748015","doi":"https://doi.org/10.71426/jcdt.v2.i2.pp207-215"},"language":"en","primary_location":{"id":"doi:10.71426/jcdt.v2.i2.pp207-215","doi":"https://doi.org/10.71426/jcdt.v2.i2.pp207-215","is_oa":false,"landing_page_url":"https://doi.org/10.71426/jcdt.v2.i2.pp207-215","pdf_url":null,"source":{"id":"https://openalex.org/S5407053917","display_name":"Journal of Computing and Data Technology","issn_l":"3107-9466","issn":["3107-9466"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computing and Data Technology","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5020997877","display_name":"Reginald Ekene Ogu","orcid":"https://orcid.org/0000-0001-9828-8839","observed_orcids":["https://orcid.org/0000-0001-9828-8839"]},"institutions":[{"id":"https://openalex.org/I16443873","display_name":"Federal University of Technology Owerri","ror":"https://ror.org/05xzf9508","country_code":"NG","type":"education","lineage":["https://openalex.org/I16443873"]}],"countries":["NG"],"is_corresponding":true,"raw_author_name":"Reginald Ekene Ogu","raw_affiliation_strings":["Department of Computer Engineering, Federal University of Technology, Owerri, Imo State, Nigeria"],"raw_orcid":"https://orcid.org/0000-0001-9828-8839","affiliations":[{"raw_affiliation_string":"Department of Computer Engineering, Federal University of Technology, Owerri, Imo State, Nigeria","institution_ids":["https://openalex.org/I16443873"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5020997877"],"corresponding_institution_ids":["https://openalex.org/I16443873"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"207","last_page":"215"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.0007999999797903001,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7160999774932861},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6438000202178955},{"id":"https://openalex.org/C154504017","wikidata":"https://www.wikidata.org/wiki/Q853614","display_name":"Identifier","level":2,"score":0.5612000226974487},{"id":"https://openalex.org/C32587265","wikidata":"https://www.wikidata.org/wiki/Q1182260","display_name":"Data deduplication","level":2,"score":0.5458999872207642},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.5339000225067139},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.45410001277923584},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.42719998955726624},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.38040000200271606},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.38019999861717224},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.361299991607666},{"id":"https://openalex.org/C119839945","wikidata":"https://www.wikidata.org/wiki/Q6545185","display_name":"Unique identifier","level":3,"score":0.35359999537467957},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3328000009059906},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.31290000677108765},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3116999864578247},{"id":"https://openalex.org/C66905080","wikidata":"https://www.wikidata.org/wiki/Q17005494","display_name":"Binary classification","level":3,"score":0.3093999922275543},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.2906000018119812},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.2892000079154968},{"id":"https://openalex.org/C2780428219","wikidata":"https://www.wikidata.org/wiki/Q16952335","display_name":"Cover (algebra)","level":2,"score":0.2888000011444092},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.28769999742507935},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.2858000099658966},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.28519999980926514},{"id":"https://openalex.org/C35341882","wikidata":"https://www.wikidata.org/wiki/Q8795","display_name":"Internet Protocol","level":3,"score":0.2806999981403351},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.2800999879837036},{"id":"https://openalex.org/C33884865","wikidata":"https://www.wikidata.org/wiki/Q1254335","display_name":"Cryptographic protocol","level":3,"score":0.27059999108314514},{"id":"https://openalex.org/C133462117","wikidata":"https://www.wikidata.org/wiki/Q4929239","display_name":"Data collection","level":2,"score":0.2671999931335449},{"id":"https://openalex.org/C2779356329","wikidata":"https://www.wikidata.org/wiki/Q922625","display_name":"Checklist","level":2,"score":0.26489999890327454},{"id":"https://openalex.org/C16910744","wikidata":"https://www.wikidata.org/wiki/Q7705759","display_name":"Test data","level":2,"score":0.25999999046325684},{"id":"https://openalex.org/C141603448","wikidata":"https://www.wikidata.org/wiki/Q134830","display_name":"Prefix","level":2,"score":0.2590000033378601},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.2551000118255615},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.25270000100135803},{"id":"https://openalex.org/C2777267654","wikidata":"https://www.wikidata.org/wiki/Q3519023","display_name":"Test (biology)","level":2,"score":0.251800000667572}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.71426/jcdt.v2.i2.pp207-215","doi":"https://doi.org/10.71426/jcdt.v2.i2.pp207-215","is_oa":false,"landing_page_url":"https://doi.org/10.71426/jcdt.v2.i2.pp207-215","pdf_url":null,"source":{"id":"https://openalex.org/S5407053917","display_name":"Journal of Computing and Data Technology","issn_l":"3107-9466","issn":["3107-9466"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computing and Data Technology","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Intrusion":[0],"detectors":[1],"trained":[2,68],"on":[3,40,70,156],"the":[4,13,41,91,98,122],"TON_IoT":[5],"network":[6],"data":[7],"routinely":[8],"report":[9],"near-perfect":[10],"scores,":[11],"but":[12],"extent":[14],"to":[15,87,132,143],"which":[16],"these":[17],"scores":[18],"reflect":[19],"attack":[20,148],"behaviour":[21],"rather":[22],"than":[23],"dataset-specific":[24],"collection":[25],"artefacts":[26],"remains":[27],"unclear.":[28],"This":[29],"study":[30],"evaluates":[31],"four":[32,35],"classifiers":[33],"using":[34,178],"progressively":[36],"stricter":[37],"evaluation":[38,165],"protocols":[39],"211,043-flow":[42],"train\u2013test":[43],"file:":[44],"naive":[45,116],"random":[46,135],"splitting":[47],"with":[48,137],"all":[49],"columns,":[50],"removal":[51],"of":[52,79,85,97,108,112],"addressing":[53],"and":[54,60,73,81,110,169],"free-text":[55],"identifiers,":[56],"deduplication":[57],"before":[58],"splitting,":[59],"holding":[61],"out":[62],"entire":[63],"attacker":[64],"hosts.":[65],"A":[66],"probe":[67],"only":[69],"IP":[71],"addresses":[72],"ports":[74],"reached":[75],"a":[76,82,119],"binary":[77],"macro-F1":[78,84,129],"0.9999":[80],"ten-class":[83],"up":[86,106],"0.932,":[88],"indicating":[89],"that":[90],"identifiers":[92,126],"alone":[93],"are":[94],"highly":[95],"predictive":[96],"labels":[99],"in":[100,121],"this":[101,179],"dataset.":[102,180],"Exact":[103],"duplicates":[104],"made":[105],"9.7%":[107],"rows,":[109],"12.1%":[111],"test":[113],"rows":[114],"under":[115],"cross-validation":[117],"had":[118],"copy":[120],"training":[123],"fold.":[124],"Removing":[125],"cut":[127],"multiclass":[128],"from":[130,141],"0.986":[131],"0.953":[133],"for":[134,175],"forest,":[136],"man-in-the-middle":[138],"F1":[139],"falling":[140],"0.903":[142],"0.757.":[144],"Under":[145],"host":[146],"hold-out,":[147],"recall":[149],"stayed":[150],"above":[151],"0.95,":[152],"while":[153],"false-alarm":[154],"rates":[155],"unseen":[157],"benign":[158],"hosts":[159],"varied":[160],"substantially":[161],"across":[162],"hold-outs.":[163],"The":[164],"protocols,":[166],"identifier-only":[167],"probe,":[168],"reporting":[170],"checklist":[171],"provide":[172],"practical":[173],"safeguards":[174],"future":[176],"studies":[177]},"counts_by_year":[],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-11-11T00:00:00"}