koda-nids

netgoat-ai/koda-nids

koda-nids is a machine learning model from netgoat-ai. Use it for the machine learning task on the model card, and read the license before you ship it in a product. It is set up for xgboost. The card lists the license as mit.

Koda-NIDS is a high-performance gradient-boosted decision tree classifier designed to identify malicious network activity. Built on the UNSW-NB15 dataset, it provides a robust defense mechanism for identifying various…

Downloads · 30 days

Access

Public

Updated Apr 4, 2026

Repo size

1.5 KB

Likes

Public

Hugging Face

Repo makeup

Click a slice to open those files.

.json1.4 MB · 100%

At a glance

Library: xgboost
License: mit
Access: Public
Created: Apr 4, 2026
Updated: Apr 4, 2026
SHA: b488c6f6

Datasets

UNSW-NB15

Model card

From the Hugging Face model README

Koda-NIDS: XGBoost Intrusion Detection System

Model Details

Field	Value
Model Name	Koda-NIDS
Model Type	XGBoost Classifier
Task	Binary Network Intrusion Detection (NIDS)
Input Features	42 network flow features (duration, protocols, TTL, etc.)
Target	`label` — `0`: Normal, `1`: Attack

Performance Summary

Evaluated on UNSW_NB15_testing-set.csv (175,341 samples), Koda-NIDS demonstrates strong generalization and exceptional precision in identifying threats.

Overall

Metric	Value
Test Accuracy	89.54%
Macro Avg Precision	0.88
Macro Avg Recall	0.92
Macro Avg F1-Score	0.89
Weighted Avg F1-Score	0.90

Per-class breakdown

Class	Precision	Recall	F1-Score	Support
`0` Normal	0.76	0.98	0.86	56,000
`1` Attack	0.99	0.86	0.92	119,341

Top 5 Predictive Features

Rank	Feature	Importance	Description
1	`sttl`	34.2%	Source Time-to-Live — high importance in identifying packet origin anomalies
2	`ct_dst_sport_ltm`	10.7%	Concentration of connections to the same destination and source port
3	`tcprtt`	9.1%	TCP round-trip time metrics
4	`ct_dst_src_ltm`	5.5%	Density of connections between specific host pairs
5	`synack`	5.3%	Timing of the TCP three-way handshake

Usage & Deployment

To deploy Koda-NIDS, ensure you have both the model weights (xgb_intrusion_model.json) and the associated label encoders (label_encoders.pkl).

Python Implementation

import xgboost as xgb
import pickle
import pandas as pd

# 1. Load the Koda-NIDS brain
model = xgb.XGBClassifier()
model.load_model("xgb_intrusion_model.json")

# 2. Load the specific encoders for proto, service, and state
with open("label_encoders.pkl", "rb") as f:
    encoders = pickle.load(f)

# 3. Predict
# Ensure your input data is preprocessed using the exact same logic
# found in the training pipeline.

Preprocessing Requirements

The model expects raw network features to be cleaned as follows:

String Normalization — Categorical features (proto, service, state) must be lowercased and stripped of whitespace.
Label Encoding — Apply the mappings from label_encoders.pkl.
Imputation — Missing numerical values should be filled with 0. Unseen categorical labels should be mapped to the missing category defined during training.

Limitations & Scope

Extraction Dependency — Koda-NIDS requires pre-extracted flow features. It does not ingest raw .pcap files directly without a feature extraction layer.
Protocol Drift — Trained on 2015 network behaviors; effectiveness against ultra-modern evasion techniques may vary.

Citation

If you use Koda-NIDS in your research, please cite the underlying dataset:

Moustafa, Nour, and Jill Slay. "UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set)." Military Communications and Information Systems Conference (MilCIS), 2015.

Library: xgboost
License: mit
Languages: en
Created: Apr 4, 2026
Updated: Apr 4, 2026