# Early-Stage Anomaly Detection: A Study of Model Performance on Complete vs. Partial Flows

arXiv: https://arxiv.org/abs/2407.02856 · HTML: https://mlsanity.com/paper/2407.02856/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 3 of its 22 references that are in the map.
- First posted on arXiv 3 Jul 2024.

## Builds on (most cited first, 3 of 3)

- [Evaluating ML-Based Anomaly Detection Across Datasets of Varied Integrity: A Case Study](https://mlsanity.com/paper/2401.16843/) (2024)
- [Utilising Flow Aggregation to Classify Benign Imitating Attacks](https://mlsanity.com/paper/2103.04208/) (2021)
- [A Flow is a Stream of Packets: A Stream-Structured Data Approach for DDoS Detection](https://mlsanity.com/paper/2405.07232/) (2024)

## Abstract (arXiv)

This study investigates the efficacy of machine learning models in network security threat detection through the critical lens of partial versus complete flow information, addressing a common gap between research settings and real-time operational needs. We systematically evaluate how a standard benchmark model, Random Forest, performs under varying training and testing conditions (complete/complete, partial/partial, complete/partial), quantifying the performance impact when dealing with the incomplete data typical in real-time environments. Our findings demonstrate a significant performance difference, with precision and recall dropping by up to 30% under certain conditions when models trained on complete flows are tested against partial flows. The study also reveals that, for the evaluated dataset and model, a minimum threshold around 7 packets in the test set appears necessary for maintaining reliable detection rates, providing valuable, quantified insights for developing more realistic real-time detection strategies.