Provenance, Not Behaviour: A Serialisation Artifact in Edge-IIoTset and a Leakage-Free Benchmark for Precision-Agriculture Intrusion Detection

• URL: http://arxiv.org/abs/2608.15761v1
• Date: Sun, 16 Aug 2026 14:30:45 GMT
• Title: Provenance, Not Behaviour: A Serialisation Artifact in Edge-IIoTset and a Leakage-Free Benchmark for Precision-Agriculture Intrusion Detection
• Abstract summary: Edge-IIoTset is the benchmark for machine-learning intrusion detection in the Internet of Things.<n>We show that much of that performance is not intrusion detection.<n>We produce AgriEdge: 1,276,122 rows, five devices with full attribution, and no column separating the classes above 0.0288.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Edge-IIoTset is the reference benchmark for machine-learning intrusion detection in the industrial Internet of Things, and results reported on it cluster above 99%. We show that much of that performance is not intrusion detection. The preprocessing recipe distributed with the dataset instructs researchers to one-hot encode seven categorical columns. Four of them separate attack from normal traffic with an accuracy of 1.0000 on their own, through the spelling of the placeholder written for an absent protocol field: the string "0" in the normal-traffic branch of the dataset build against "0.0" in the attack branch. The label is recoverable from a serialisation artifact encoding file provenance, with no network behaviour modelled, and separates every row of both curated subsets. Under 5-fold x 3-repeat cross-validation, five of six standard classifiers attain exactly 1.0000 +/- 0.0000 accuracy and the sixth attains 0.99998. Under a corrected protocol, naive Bayes falls by 0.3005 macro-F1 and the strongest model settles at 0.9503 +/- 0.0011. Label, ordinal and frequency encoding leak identically. Because the curated subsets also lack Modbus and per-device identity, we rebuild the benchmark from the raw captures under uniform parsing, producing AgriEdge: 1,276,122 rows, five devices with full attribution, and no column separating the classes above 0.0288. A leave-one-device-out sweep locates the generalisation boundary at the perception/actuation layer, where random forest falls from 0.9988 to 0.5083 balanced accuracy. Non-IID federated partitioning costs at most 0.0037 macro-F1, but a 20-round LoRaWAN training run costs 4.6 hours of uplink.

Related papers

• Benchmarking Quantum Machine Learning for Power-System Attack Detection: Evaluation Choices Decide the Outcome Before the Models Do [0.0]
  We benchmark machine learning detectors for power-system cyberattacks against tuned classical models.<n>The benchmark's answers are set by the evaluator's choices before the models.<n>A positive control explains the accuracy null: the labels, not the pipeline.
  arXiv  Detail & Related papers  (2026-08-16T08:32:39Z)
• Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion [46.262619407930266]
  We train a multi-label classifier on a curated gold dataset of 1,207 CVEs from expert MITRE Center for Threat-Informed Defense mappings.<n>The resulting model approximately doubles recall@5 compared with a zero-shot embedding-similarity baseline.<n>We then investigate whether LLM-assisted labeling can extend the gold dataset.
  arXiv  Detail & Related papers  (2026-07-28T10:59:04Z)
• Closed-loop Auto Research for Molecular Property Prediction: Discovering and Certifying Generalizable Improvements [23.74905101390208]
  Closed-loop Auto Research extends automated machine learning from fixed-dataset fitting to changing the research workflow.<n>We ask whether this action space yields improvements generalizing beyond the validation signal selecting them.<n>Across 36 endpoints in three benchmark suites we score each selected configuration once on a held-out test whose labels the search never read.
  arXiv  Detail & Related papers  (2026-06-22T00:18:27Z)
• A Modelling and Evaluation Framework for EuroCrops-Driven Sentinel-2 Crop Segmentation [78.66324246922831]
  This work presents a pipeline for generating semantic-segmentation-ready agricultural datasets from Sentinel-2 imagery and EuroCrops parcel-level annotations.<n>The dataset contains 67,337 patches from five European countries and uses a reduced taxonomy of ten crop classes plus background.<n>A four-level U-Net with Group Normalization was trained using 10 Sentinel-2 spectral bands and a composite loss combining class-weighted cross-entropy and Dice loss.
  arXiv  Detail & Related papers  (2026-05-30T11:20:29Z)
• Distributional Energy-Based Models for Uncertainty-Aware Structured LLM Reasoning [40.342912574072024]
  Large Language Models produce structured outputs such as travel plans or code solutions.<n>Individual reasoning steps may appear correct while the output as a whole violates budgets, fails test cases, or contradicts earlier deductions.<n>We propose a learned quality scorer with deterministic analytical constraint penalties for verifying structured LLM outputs.
  arXiv  Detail & Related papers  (2026-05-15T17:08:27Z)
• Context-Aware Web Attack Detection in Open-Source SIEM Systems via MITRE ATT&CK-Enriched Behavioral Profiling [0.0]
  We present Smart-SIEM, an AI module for the open-source Wazuh SIEM platform.<n>A behavioural context vector encoding HTTP response-status distributions is used.<n>A two-stage hybrid cascade combines LightGBM for binary attack detection and XGBoost for six-class attack categorisation.
  arXiv  Detail & Related papers  (2026-05-13T10:54:36Z)
• Reducing Maintenance Burden in Behaviour-Driven Development: A Paraphrase-Robust Duplicate-Step Detector with a 1.1M-Step Open Benchmark [1.9537983097153042]
  Behaviour-Driven Development suites accumulate step-duplicate duplication with documented maintenance cost.<n>We release the largest cross-organisational BDD step corpus to date.
  arXiv  Detail & Related papers  (2026-04-22T11:44:05Z)
• Open-Set Vein Biometric Recognition with Deep Metric Learning [0.0]
  We rigorously evaluate the computational boundaries of Deep Metric Learning (DML) under strict open-set constraints.<n>Our approach learns discnative L2-normalised embeddings and employs prototype-based matching with a similarity threshold.<n>On the large-scale MMCBNU 6000 benchmark, our best model (ResNet50-CBAM) achieves an OSCR of 0.9945, AUROC of 0.9974, and EER of 1.57%, maintaining high identification accuracy (99.6% Rank-1) while robustly rejecting unknown subjects.
  arXiv  Detail & Related papers  (2026-04-16T11:03:11Z)
• BRIDGE and TCH-Net: Heterogeneous Benchmark and Multi-Branch Baseline for Cross-Domain IoT Botnet Detection [1.2019888796331233]
  IoT botnet detection has advanced, yet most published systems are validated on a single dataset and rarely generalise across environments.<n>We introduce BRIDGE, the first formally specified heterogeneous multi-dataset benchmark for IoT intrusion detection.<n>We establish the first community generalisation baseline at mean LODO F1 = 0.5577, a result that shifts the agenda from single-benchmark optimisation to cross-environment generalisation.
  arXiv  Detail & Related papers  (2026-04-13T11:25:39Z)
• Hybrid-Segmentor: A Hybrid Approach to Automated Fine-Grained Crack Segmentation in Civil Infrastructure [52.2025114590481]
  We introduce Hybrid-Segmentor, an encoder-decoder based approach that is capable of extracting both fine-grained local and global crack features. This allows the model to improve its generalization capabilities in distinguish various type of shapes, surfaces and sizes of cracks. The proposed model outperforms existing benchmark models across 5 quantitative metrics (accuracy 0.971, precision 0.804, recall 0.744, F1-score 0.770, and IoU score 0.630), achieving state-of-the-art status.
  arXiv  Detail & Related papers  (2024-09-04T16:47:16Z)
• Conformal Predictor for Improving Zero-shot Text Classification Efficiency [37.745518881553416]
  We reduce the average inference time for NLI- and NSP-based models by 25.6% and 22.2% respectively. With a suitable CP for each dataset, we reduce the average inference time for NLI- and NSP-based models by 25.6% and 22.2% respectively.
  arXiv  Detail & Related papers  (2022-10-23T05:19:50Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.