# Flow Exporter Impact on Intelligent Intrusion Detection Systems

arXiv: https://arxiv.org/abs/2412.14021 · HTML: https://mlsanity.com/paper/2412.14021/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 21 references that are in the map.
- First posted on arXiv 18 Dec 2024.

## Builds on (most cited first, 3 of 3)

- [Towards a Standard Feature Set for Network Intrusion Detection System Datasets](https://mlsanity.com/paper/2101.11315/) (2021)
- [Towards Adversarial Realism and Robust Learning for IoT Intrusion Detection and Classification](https://mlsanity.com/paper/2301.13122/) (2023)
- [An Adversarial Robustness Benchmark for Enterprise Network Intrusion Detection](https://mlsanity.com/paper/2402.16912/) (2024)

## Built on by (most cited first, 1 of 1)

- [Machine Unlearning for the XGBoost Model with Network Intrusion Datasets](https://mlsanity.com/paper/2606.19220/) (2026)

## Abstract (arXiv)

High-quality datasets are critical for training machine learning models, as inconsistencies in feature generation can hinder the accuracy and reliability of threat detection. For this reason, ensuring the quality of the data in network intrusion detection datasets is important. A key component of this is using reliable tools to generate the flows and features present in the datasets. This paper investigates the impact of flow exporters on the performance and reliability of machine learning models for intrusion detection. Using HERA, a tool designed to export flows and extract features, the raw network packets of two widely used datasets, UNSW-NB15 and CIC-IDS2017, were processed from PCAP files to generate new versions of these datasets. These were compared to the original ones in terms of their influence on the performance of several models, including Random Forest, XGBoost, LightGBM, and Explainable Boosting Machine. The results obtained were significant. Models trained on the HERA version of the datasets consistently outperformed those trained on the original dataset, showing improvements in accuracy and indicating a better generalisation. This highlighted the importance of flow generation in the model's ability to differentiate between benign and malicious traffic.