Using cost measures and model simplicity to extrapolate performance in network intrusion detection systems

Privacy issues prevent network intrusion detection data sets from being freely shared among researchers. To address this, synthetic data sets such as the DARPA 98 and 99 datasets were developed to train, test and benchmark network intrusion detection systems (NIDS) [6]. The use of such synthetic datasets can create problems when researchers attempt to extrapolate performance to real-world situations.