pcap-ml-traffic-classifier

NIDS-CatBoost — Network Intrusion Detector

A CatBoost binary classifier (benign vs. malicious) trained on the full CIC-IDS-2017 dataset using the 78 standard CICFlowMeter flow-level features.

Companion artifact to pop123-ux/pcap-ml-traffic-classifier on GitHub.

---

Model at a glance

---

Evaluation

Metrics on a stratified 30 % hold-out split of the combined CIC-IDS-2017 dataset (848,363 flows):

Operationally: on ~167 k real attack flows, the model missed effectively zero (recall ≈ 1.000). Of everything it flagged as malicious, 99.5 % actually were — about 5 false positives per 1,000 alerts. That's a workable ratio for a SOC analyst rather than alert-fatigue territory.

⚠️ Read before deploying. These numbers come from a random hold-out drawn from the same 8-day capture as the training data — same network, same attack tools, same time window. Cross-network generalization to a different corporate LAN or novel attacker tooling is not measured here and is expected to be lower. Treat this as a strong CIC-IDS-2017 benchmark result, not a plug-and-play production IDS.

---

Usage

from catboost import CatBoostClassifier
from huggingface_hub import hf_hub_download
import pandas as pd

# Download and load the model (cached under ~/.cache/huggingface after first run)
path = hf_hub_download(
    repo_id="pop123ux/pcap-ml-traffic-classifier",
    filename="cicids_catboost.cbm",
)
model = CatBoostClassifier().load_model(path)

# X must be a DataFrame containing the 78 CICFlowMeter features in the same
# order the model was trained on — check with model.feature_names_
X = pd.read_csv("your_cicflowmeter_output.csv")
preds = model.predict(X)         # 0 = benign, 1 = malicious
probs = model.predict_proba(X)   # calibrated malicious probability

From raw PCAP to prediction

The model expects flow-level features, not raw packets. Convert PCAPs first with CICFlowMeter:

cicflowmeter -f suspicious.pcap -c flows.csv
python3 load_pretrained.py flows.csv   # helper script in the GitHub repo

---

Feature schema

Standard CICFlowMeter feature set — flow duration, forward/backward packet counts and byte totals, packet-length distributions, inter-arrival-time statistics, TCP flag counts, active/idle timings, etc. The full ordered feature list is embedded in cicids_catboost.json (also included in this repo).

---

Intended use

• Defensive-security research and blue-team tooling
• Educational demonstrations of ML applied to intrusion detection
• Baseline for CIC-IDS-2017 benchmarking

Out of scope

• Live packet inspection without a CICFlowMeter-equivalent flow aggregator
• Attack families not represented in CIC-IDS-2017 (modern C2 frameworks, encrypted-tunnel exfiltration, zero-days)
• Any deployment without independent validation on your own network's traffic

---

Training details

• Framework: CatBoost 1.2+
• Hardware: Google Colab (CPU runtime)
• Split: 70 / 30 stratified train / test
• Iterations: 500 with early_stopping_rounds=50
• Learning rate: 0.05
• Depth: 6

---

License

MIT — see the source repository.

Citation

@misc{pcap_ml_traffic_classifier_2026,
  author       = {pop123-ux},
  title        = {pcap-ml-traffic-classifier: CatBoost-Powered Network Intrusion Detection},
  year         = {2026},
  publisher    = {GitHub},
  howpublished = {\url{https://github.com/pop123-ux/pcap-ml-traffic-classifier}}
}