Manuscript2026

Confidently Wrong: Ranking Inversion in Cross-Network Denial-of-Service Detection

Rajveer Singh Pall

On a new network, DoS detectors do not decay toward chance: many pass through it and score attacks below benign traffic.

The discovery in one figure

ROC-AUC OF DETECTORS MOVED TO A NEW NETWORKnegate the score and the same detector ranks well0.06970.93030.5below chance: attacks ranked under benign trafficabove chance108 OF 240 RUN-LEVEL EVALUATIONS SCORE BELOW 0.511 OF 12 TESTBED PAIRS FAIL AT THE RANKINGThe open square: the one pair where recalibration can help.TEN LABELLED TARGET FLOWSmedian macro-F1, no adaptation: 0.3919after retraining on them: 0.7253

Swipe to see the whole figure

Many cross-network detectors do not fall to chance. They pass through it and rank attacks below benign traffic.

The paper in five minutes

Flow-based denial-of-service detectors report accuracy above 99%, then lose most of that skill on a different network. This paper looks at the character of that loss. Where the ordering of scores survives the move, choosing a new threshold repairs it. Where the ordering has inverted, no threshold can, and the scoring function itself has to change.

The research question

When a DoS detector moves to a new network, does it fail at the threshold or at the ranking, and which remedies can work?

How it works

Four model families are trained on four independently captured testbeds under a published common feature set, and every ordered pair of testbeds is evaluated over five seeds.

  1. 01
    Four testbedsindependently captured, one published common feature set
  2. 02
    Four model familiestrained on each testbed
  3. 03
    Every ordered pair12 cross-network transfers, five seeds, 240 evaluations
  4. 04
    Diagnose the failureranking loss versus threshold loss, then test remedies

Experimental results

Transfer does not decay toward chance; it passes through chance. 108 of 240 run-level evaluations score below ROC-AUC 0.5, and the worst reaches 0.0697, where negating the score would give 0.9303. Eleven of twelve testbed pairs fail at the ranking rather than the threshold. Retraining on ten balanced labelled target flows reaches median macro-F1 0.7253, against 0.3919 without adaptation.

  • 108 / 240evaluations below ROC-AUC 0.5
  • 0.0697worst ROC-AUC (0.9303 if negated)
  • 11 / 12testbed pairs fail at the ranking

Figures from the paper

How each testbed pair fails. Only one of twelve pairs sits in the threshold-limited region where recalibration can help; the rest lose their ranking.
Fig. 1How each testbed pair fails. Only one of twelve pairs sits in the threshold-limited region where recalibration can help; the rest lose their ranking.

Figures as generated by the paper’s own analysis pipeline.

What this changes

Cross-network evaluation has to separate ranking failure from threshold failure, because the two admit different fixes.

Resources

Not public yetCode is not public yet.

  • Network Security
  • Deployment Shift

Citation

Manuscript. A draft is available on request. Reach me at rajveerpall04@gmail.com.

Where this leads next