Network Intrusion Detection under Changing Traffic and Delayed Labels

Abstract

A transparent historical benchmark experiment is used to distinguish intrusion classification from adaptive deployment claims. A fixed ridge-margin detector is fitted to 25,192 public NSL-KDD training records and evaluated on 22,544 designated test records. Training-only scaling and categorical levels are used, and the final difficulty field is excluded. Test accuracy is 0.76260, attack recall is 0.63415, and the normal false-positive rate is 0.06766. Recall is 0.44776 for 3,752 attack rows whose source labels are absent from training. Analytic prevalence calculations expose alert-workload consequences. Literature through 2026 motivates chronological replay and independent candidate promotion. These results do not estimate current-network performance.