<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-05194730</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-15T15:30:20+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">How dataset diversity affects generalization in ML-based NIDS</title>
            <author role="aut">
              <persName>
                <forename type="first">Benoit</forename>
                <surname>Nougnanke</surname>
              </persName>
              <email type="md5">a33de712badef05355fc966e62d4a644</email>
              <email type="domain">laas.fr</email>
              <idno type="idhal" notation="string">kokouvi-benoit-nougnanke</idno>
              <idno type="idhal" notation="numeric">737625</idno>
              <idno type="halauthorid" notation="string">3400669-737625</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-0503-8986</idno>
              <idno type="IDREF">https://www.idref.fr/257301887</idno>
              <affiliation ref="#struct-563936"/>
              <affiliation ref="#struct-95600"/>
              <affiliation ref="#struct-1101446"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Gregory</forename>
                <surname>Blanc</surname>
              </persName>
              <email type="md5">8bb9c8c6b1f1a95e5f373658e053ebcb</email>
              <email type="domain">telecom-sudparis.eu</email>
              <idno type="idhal" notation="string">blanc-gregory</idno>
              <idno type="idhal" notation="numeric">177186</idno>
              <idno type="halauthorid" notation="string">28999-177186</idno>
              <idno type="IDREF">https://www.idref.fr/235400564</idno>
              <idno type="ORCID">https://orcid.org/0000-0001-8150-6617</idno>
              <idno type="GOOGLE SCHOLAR">9Tf1a1cAAAAJ</idno>
              <affiliation ref="#struct-563936"/>
              <affiliation ref="#struct-95600"/>
              <affiliation ref="#struct-1101446"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Thomas</forename>
                <surname>Robert</surname>
              </persName>
              <email type="md5">0623ab37c537ac20d6ca468ba8c12f43</email>
              <email type="domain">telecom-paris.fr</email>
              <idno type="idhal" notation="string">thomas-robert-h</idno>
              <idno type="idhal" notation="numeric">736574</idno>
              <idno type="halauthorid" notation="string">46451-736574</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-4423-5720</idno>
              <affiliation ref="#struct-554439"/>
              <affiliation ref="#struct-121818"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Benoit</forename>
                <surname>NOUGNANKE</surname>
              </persName>
              <email type="md5">a33de712badef05355fc966e62d4a644</email>
              <email type="domain">laas.fr</email>
            </editor>
            <funder ref="#projanr-69631"/>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2025-07-31 15:07:33</date>
              <date type="whenModified">2026-01-21 03:34:06</date>
              <date type="whenReleased">2025-08-12 15:56:57</date>
              <date type="whenProduced">2025-09-22</date>
              <date type="whenEndEmbargoed">2025-07-31</date>
              <ref type="file" target="https://hal.science/hal-05194730v1/document">
                <date notBefore="2025-07-31"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-05194730v1/file/ESORICS_2025_Paper_CR.pdf" id="file-5194730-4475563">
                <date notBefore="2025-07-31"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="930184">
                <persName>
                  <forename>Benoit</forename>
                  <surname>NOUGNANKE</surname>
                </persName>
                <email type="md5">a33de712badef05355fc966e62d4a644</email>
                <email type="domain">laas.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-05194730</idno>
            <idno type="halUri">https://hal.science/hal-05194730</idno>
            <idno type="halBibtex">nougnanke:hal-05194730</idno>
            <idno type="halRefHtml">&lt;i&gt;30th European Symposium on Research in Computer Security (ESORICS)&lt;/i&gt;, Sep 2025, Toulouse, France. pp.269 - 288, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-032-07884-1_14"&gt;&amp;#x27E8;10.1007/978-3-032-07884-1_14&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">30th European Symposium on Research in Computer Security (ESORICS), Sep 2025, Toulouse, France. pp.269 - 288, &amp;#x27E8;10.1007/978-3-032-07884-1_14&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://about.hal.science/hal-authorisation-v1/">HAL Authorization<ref corresp="#file-5194730-4475563"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="ENST">Ecole Nationale Supérieure des Télécommunications</idno>
            <idno type="stamp" n="TELECOM-PARISTECH" corresp="PARISTECH">Télécom Paris</idno>
            <idno type="stamp" n="TELECOM-SUDPARIS" corresp="INSTITUT-MINES-TELECOM">Télécom SudParis</idno>
            <idno type="stamp" n="LTCI" corresp="TELECOM-PARISTECH">Laboratoire Traitement et Communication de l'Information</idno>
            <idno type="stamp" n="INFRES" corresp="TELECOM-PARISTECH">Département Informatique et Réseaux</idno>
            <idno type="stamp" n="ACES" corresp="TELECOM-PARISTECH">Equipe Autonomic and Critical Embedded Systems</idno>
            <idno type="stamp" n="IP_PARIS">Institut Polytechnique de Paris</idno>
            <idno type="stamp" n="INSTITUTS-TELECOM">composantes instituts telecom </idno>
            <idno type="stamp" n="ANR">ANR</idno>
            <idno type="stamp" n="SUPERVIZ">Projet Supervision et orchestration de la sécurité (PEPR Cybersécurité) </idno>
            <idno type="stamp" n="CYBERSCURITE">PEPR Cybersécurité</idno>
            <idno type="stamp" n="INSTITUT-MINES-TELECOM">Institut Mines Telecom</idno>
            <idno type="stamp" n="IP-PARIS-DEPARTEMENT-MATHEMATIQUES">Département de Mathèmatiques</idno>
            <idno type="stamp" n="IP-PARIS-MATHEMATIQUES">IP Paris Département de Mathématiques</idno>
            <idno type="stamp" n="IP-PARIS-INFORMATION-COMMUNICATION-ELECTRONIQUE">IP Paris Département d'Information, de Communication et d'Électronique</idno>
            <idno type="stamp" n="IP-PARIS-INFORMATIQUE-DONNEES-ET-IA">IP Paris Département d'Informatique, de Données et d'IA</idno>
            <idno type="stamp" n="SAMOVAR">Services répartis, Architectures, Modélisation, Validation, Administration des Réseaux</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">How dataset diversity affects generalization in ML-based NIDS</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Benoit</forename>
                    <surname>Nougnanke</surname>
                  </persName>
                  <email type="md5">a33de712badef05355fc966e62d4a644</email>
                  <email type="domain">laas.fr</email>
                  <idno type="idhal" notation="string">kokouvi-benoit-nougnanke</idno>
                  <idno type="idhal" notation="numeric">737625</idno>
                  <idno type="halauthorid" notation="string">3400669-737625</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-0503-8986</idno>
                  <idno type="IDREF">https://www.idref.fr/257301887</idno>
                  <affiliation ref="#struct-563936"/>
                  <affiliation ref="#struct-95600"/>
                  <affiliation ref="#struct-1101446"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Gregory</forename>
                    <surname>Blanc</surname>
                  </persName>
                  <email type="md5">8bb9c8c6b1f1a95e5f373658e053ebcb</email>
                  <email type="domain">telecom-sudparis.eu</email>
                  <idno type="idhal" notation="string">blanc-gregory</idno>
                  <idno type="idhal" notation="numeric">177186</idno>
                  <idno type="halauthorid" notation="string">28999-177186</idno>
                  <idno type="IDREF">https://www.idref.fr/235400564</idno>
                  <idno type="ORCID">https://orcid.org/0000-0001-8150-6617</idno>
                  <idno type="GOOGLE SCHOLAR">9Tf1a1cAAAAJ</idno>
                  <affiliation ref="#struct-563936"/>
                  <affiliation ref="#struct-95600"/>
                  <affiliation ref="#struct-1101446"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Thomas</forename>
                    <surname>Robert</surname>
                  </persName>
                  <email type="md5">0623ab37c537ac20d6ca468ba8c12f43</email>
                  <email type="domain">telecom-paris.fr</email>
                  <idno type="idhal" notation="string">thomas-robert-h</idno>
                  <idno type="idhal" notation="numeric">736574</idno>
                  <idno type="halauthorid" notation="string">46451-736574</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-4423-5720</idno>
                  <affiliation ref="#struct-554439"/>
                  <affiliation ref="#struct-121818"/>
                </author>
              </analytic>
              <monogr>
                <idno type="isbn">978-3-032-07883-4</idno>
                <title level="m">ESORICS 2025 - 30th European Symposium on Research in Computer Security</title>
                <meeting>
                  <title>30th European Symposium on Research in Computer Security (ESORICS)</title>
                  <date type="start">2025-09-22</date>
                  <date type="end">2025-09-26</date>
                  <settlement>Toulouse</settlement>
                  <country key="FR">France</country>
                </meeting>
                <imprint>
                  <publisher>ACM</publisher>
                  <biblScope unit="pp">269 - 288</biblScope>
                  <date type="datePub">2025-10-23</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-032-07884-1_14</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Measurement Theory</term>
                <term xml:lang="en">Performance Evaluation</term>
                <term xml:lang="en">Generalization</term>
                <term xml:lang="en">Machine Learning</term>
                <term xml:lang="en">Diversity</term>
                <term xml:lang="en">NIDS Datasets</term>
              </keywords>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Machine Learning-based Network Intrusion Detection Systems (ML-based NIDS) rely heavily on the quality of the datasets used for training and evaluation. However, widely used NIDS benchmarks often suffer from poor data diversity, which limits model generalization and undermines the reliability of evaluation protocols. While prior work has acknowledged this limitation, a systematic framework to quantify dataset diversity and analyze its relationship with performance is still missing. To address this gap, we introduce a structured approach for characterizing dataset diversity in ML-based NIDS, grounded in measurement theory. We distinguish three types of diversity-intra-class, inter-class, and domain-shift-and operationalize their measurement using established metrics such as the Vendi Score and the Jensen-Shannon divergence. Our empirical analysis on the CIC-IDS2018 dataset, spanning sixty diversity-controlled train-test experiments, provides new insights into the relationship between diversity and generalization and demonstrates the value of diversity-aware data sampling for improving evaluation reliability.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="regroupinstitution" xml:id="struct-563936" status="VALID">
          <idno type="IdRef">238327159</idno>
          <idno type="ISNI">0000000502717600</idno>
          <idno type="ROR">https://ror.org/042tfbd02</idno>
          <idno type="Wikidata">Q48759778</idno>
          <orgName>Institut Polytechnique de Paris</orgName>
          <orgName type="acronym">IP Paris</orgName>
          <date type="start">2019-06-02</date>
          <desc>
            <address>
              <addrLine>Route de Saclay, 91120 Palaiseau Cedex, France</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.ip-paris.fr</ref>
          </desc>
        </org>
        <org type="department" xml:id="struct-95600" status="VALID">
          <orgName>Département Réseaux et Services de Télécommunications</orgName>
          <orgName type="acronym">TSP - RST</orgName>
          <desc>
            <address>
              <addrLine>Télécom SudParis - 9 rue Charles Fourier - 91011 Évry cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://rst.telecom-sudparis.eu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-352124" type="direct"/>
            <relation active="#struct-302102" type="indirect"/>
            <relation name="563936" active="#struct-563936" type="indirect"/>
          </listRelation>
        </org>
        <org type="researchteam" xml:id="struct-1101446" status="VALID">
          <orgName>Sécurité et Confiance Numérique</orgName>
          <orgName type="acronym">SCN-SAMOVAR</orgName>
          <date type="start">2022-06-01</date>
          <desc>
            <address>
              <addrLine>Télécom Sudparis, 9 rue Charles Fourier -91011 Evry-Courcouronnes cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://samovar.telecom-sudparis.eu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-638" type="direct"/>
            <relation active="#struct-352124" type="indirect"/>
            <relation active="#struct-302102" type="indirect"/>
            <relation name="563936" active="#struct-563936" type="indirect"/>
          </listRelation>
        </org>
        <org type="researchteam" xml:id="struct-554439" status="VALID">
          <orgName>Autonomic and Critical Embedded Systems</orgName>
          <orgName type="acronym">ACES</orgName>
          <date type="start">2019-02-22</date>
          <desc>
            <address>
              <addrLine>Télécom Paris 19 Place Marguerite Perey 91120 PALAISEAU</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://ltci.telecom-paristech.fr/research-team/aces/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-484335" type="direct"/>
            <relation active="#struct-302102" type="indirect"/>
            <relation active="#struct-1048346" type="indirect"/>
            <relation active="#struct-563936" type="indirect"/>
          </listRelation>
        </org>
        <org type="department" xml:id="struct-121818" status="VALID">
          <orgName>Département Informatique et Réseaux</orgName>
          <orgName type="acronym">INFRES</orgName>
          <desc>
            <address>
              <addrLine>46, rue Barrault 75013 Paris</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.telecom-paris.fr/fr/recherche/laboratoires/laboratoire-traitement-et-communication-de-linformation-ltci/les-departements-denseignement-et-recherche</ref>
          </desc>
          <listRelation>
            <relation active="#struct-300362" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-352124" status="VALID">
          <idno type="IdRef">162347510</idno>
          <idno type="ISNI">0000000406406351</idno>
          <idno type="ROR">https://ror.org/05xvk4r52</idno>
          <idno type="Wikidata">Q43305</idno>
          <orgName>Télécom SudParis</orgName>
          <orgName type="acronym">TSP</orgName>
          <desc>
            <address>
              <addrLine>9 rue Charles Fourier -91011 Evry Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.telecom-sudparis.eu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-302102" type="direct"/>
            <relation name="563936" active="#struct-563936" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-302102" status="VALID">
          <idno type="IdRef">192427156</idno>
          <idno type="ISNI">000000012202567X</idno>
          <idno type="ROR">https://ror.org/025vp2923</idno>
          <idno type="Wikidata">Q27962533</idno>
          <orgName>Institut Mines-Télécom [Paris]</orgName>
          <orgName type="acronym">IMT</orgName>
          <date type="start">2012-03-01</date>
          <desc>
            <address>
              <addrLine>19 Place Marguerite Perey, 91120 Palaiseau</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.imt.fr/</ref>
          </desc>
        </org>
        <org type="laboratory" xml:id="struct-638" status="VALID">
          <idno type="IdRef">281286515</idno>
          <idno type="ISNI">0000000403830480</idno>
          <idno type="RNSR">200319330C</idno>
          <orgName>Services répartis, Architectures, MOdélisation, Validation, Administration des Réseaux</orgName>
          <orgName type="acronym">SAMOVAR</orgName>
          <desc>
            <address>
              <addrLine>Télécom Sudparis, 9 rue Charles Fourier -91011 Evry cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://samovar.telecom-sudparis.eu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-352124" type="direct"/>
            <relation active="#struct-302102" type="indirect"/>
            <relation name="563936" active="#struct-563936" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-484335" status="VALID">
          <idno type="IdRef">162384270</idno>
          <idno type="ISNI">0000 0000 9194 9502</idno>
          <idno type="RNSR">200319327Z</idno>
          <idno type="ROR">https://ror.org/057er4c39</idno>
          <orgName>Laboratoire Traitement et Communication de l'Information</orgName>
          <orgName type="acronym">LTCI</orgName>
          <date type="start">2017-01-01</date>
          <desc>
            <address>
              <addrLine>Télécom Paris 19 Place Marguerite Perey 91120 PALAISEAU</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.telecom-paris.fr/fr/recherche/laboratoires/laboratoire-traitement-et-communication-de-linformation-ltci</ref>
          </desc>
          <listRelation>
            <relation active="#struct-302102" type="direct"/>
            <relation active="#struct-1048346" type="direct"/>
            <relation active="#struct-563936" type="indirect"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-1048346" status="VALID">
          <idno type="IdRef">026375273</idno>
          <idno type="ISNI">0000 0001 2108 2779</idno>
          <idno type="ROR">https://ror.org/01naq7912</idno>
          <orgName>Télécom Paris</orgName>
          <date type="start">2019-06-12</date>
          <desc>
            <address>
              <addrLine>19 Place Marguerite Perey 91120 Palaiseau</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.telecom-paris.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-302102" type="direct"/>
            <relation active="#struct-563936" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-300362" status="VALID">
          <idno type="ROR">https://ror.org/01naq7912</idno>
          <orgName>Télécom ParisTech</orgName>
          <date type="start">2008-01-01</date>
          <date type="end">2019-06-11</date>
          <desc>
            <address>
              <addrLine>46 rue Barrault 75634 Paris Cedex 13</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.telecom-paris.fr</ref>
          </desc>
        </org>
      </listOrg>
      <listOrg type="projects">
        <org type="anrProject" xml:id="projanr-69631" status="VALID">
          <idno type="anr">ANR-22-PECY-0008</idno>
          <orgName>SuperViz</orgName>
          <desc>SuperViz</desc>
          <date type="start">2022</date>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>