Predicting F1-Scores of Classifiers in Network Intrusion Detection Systems

With the evolution of the Internet of Things, network intrusion detection systems (NIDS) are vital for protecting networks by monitoring and analyzing network traffic to detect potential cyber threats. Deep neural networks (DNNs) are widely used in NIDS for their accurate classification and response capabilities against threats. However, there is a lack of detailed discussion in the literature about evaluating DNN performance in real-time scenarios for monitoring and assurance of NIDS. This paper fills this gap by applying multiple linear regression models to predict the F1-score of a DNN attack classifier. The predictive models are evaluated using a pre-trained DNN on a NIDS benchmark dataset, where three different distance metrics computed between real-time instances and known attack patterns stored in historical data are considered as model covariates. Our findings show that the multiple linear regression model with interaction between covariates confidently forecasts the F1-score for future periods, demonstrating its ability to anticipate future observations with an empirical coverage of 94.4%.