# Data Curation and Quality Assurance for Machine Learning-based Cyber Intrusion Detection

arXiv: https://arxiv.org/abs/2105.10041 · HTML: https://mlsanity.com/paper/2105.10041/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 68 references that are in the map.
- First posted on arXiv 20 May 2021.

## Builds on (most cited first, 9 of 9)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Pervasive Label Errors in Test Sets Destabilize Machine Learning Benchmarks](https://mlsanity.com/paper/2103.14749/) (2021)
- [A Survey of Network-based Intrusion Detection Data Sets](https://mlsanity.com/paper/1903.02460/) (2019)
- [BoostClean: Automated Error Detection and Repair for Machine Learning](https://mlsanity.com/paper/1711.01299/) (2017)
- [Benchmarking datasets for Anomaly-based Network Intrusion Detection: KDD CUP 99 alternatives](https://mlsanity.com/paper/1811.05372/) (2018)
- [Machine Learning for Anomaly Detection and Categorization in Multi-cloud Environments](https://mlsanity.com/paper/1812.05443/) (2018)
- [CAMLPAD: Cybersecurity Autonomous Machine Learning Platform for Anomaly Detection](https://mlsanity.com/paper/1907.10442/) (2019)
- [Knowledge Graph semantic enhancement of input data for improving AI](https://mlsanity.com/paper/2005.04726/) (2020)
- [Sequence Covering for Efficient Host-Based Intrusion Detection](https://mlsanity.com/paper/1712.02084/) (2017)

## Abstract (arXiv)

Intrusion detection is an essential task in the cyber threat environment. Machine learning and deep learning techniques have been applied for intrusion detection. However, most of the existing research focuses on the model work but ignores the fact that poor data quality has a direct impact on the performance of a machine learning system. More attention should be paid to the data work when building a machine learning-based intrusion detection system. This article first summarizes existing machine learning-based intrusion detection systems and the datasets used for building these systems. Then the data preparation workflow and quality requirements for intrusion detection are discussed. To figure out how data and models affect machine learning performance, we conducted experiments on 11 HIDS datasets using seven machine learning models and three deep learning models. The experimental results show that BERT and GPT were the best algorithms for HIDS on all of the datasets. However, the performance on different datasets varies, indicating the differences between the data quality of these datasets. We then evaluate the data quality of the 11 datasets based on quality dimensions proposed in this paper to determine the best characteristics that a HIDS dataset should possess in order to yield the best possible result. This research initiates a data quality perspective for researchers and practitioners to improve the performance of machine learning-based intrusion detection.