You can deploy this model and start earning money today!

pop123ux/
pcap-ml-traffic-classifier

Name: pcap-ml-traffic-classifier
Availability: InStock

catboost

network-security

intrusion-detection

tabular-classification

Views

No views yet

NIDS-CatBoost — Network Intrusion Detector

A CatBoost binary classifier (benign vs. malicious) trained on the full CIC-IDS-2017 dataset using the 78 standard CICFlowMeter flow-level features.

Companion artifact to pop123-ux/pcap-ml-traffic-classifier on GitHub.

Model at a glance


Architecture	CatBoost — symmetric oblivious decision trees
Task	Binary classification (`0` = benign, `1` = malicious)
Input	78 CICFlowMeter flow features per connection
Training data	CIC-IDS-2017 — all 8 daily captures, ~2.8 M labeled flows
Class balancing	`auto_class_weights='Balanced'` (benign traffic ~4× more common)
Regularization	L2 leaf reg, early stopping on validation F1
File	`cicids_catboost.cbm` (CatBoost native binary)

Evaluation

Metrics on a stratified 30 % hold-out split of the combined CIC-IDS-2017 dataset (848,363 flows):

Class	Precision	Recall	F1	Support
Benign (0)	1.000	0.999	0.999	681,396
Malicious (1)	0.995	1.000	0.997	166,967
Accuracy			0.999	848,363
Macro avg	0.997	0.999	0.998	848,363
Weighted avg	0.999	0.999	0.999	848,363

Operationally: on ~167 k real attack flows, the model missed effectively zero (recall ≈ 1.000). Of everything it flagged as malicious, 99.5 % actually were — about 5 false positives per 1,000 alerts. That's a workable ratio for a SOC analyst rather than alert-fatigue territory.

⚠️ Read before deploying. These numbers come from a random hold-out drawn from the same 8-day capture as the training data — same network, same attack tools, same time window. Cross-network generalization to a different corporate LAN or novel attacker tooling is not measured here and is expected to be lower. Treat this as a strong CIC-IDS-2017 benchmark result, not a plug-and-play production IDS.

Usage

python

from catboost import CatBoostClassifier
from huggingface_hub import hf_hub_download
import pandas as pd

# Download and load the model (cached under ~/.cache/huggingface after first run)
path = hf_hub_download(
    repo_id="pop123ux/pcap-ml-traffic-classifier",
    filename="cicids_catboost.cbm",
)
model = CatBoostClassifier().load_model(path)

# X must be a DataFrame containing the 78 CICFlowMeter features in the same
# order the model was trained on — check with model.feature_names_
X = pd.read_csv("your_cicflowmeter_output.csv")
preds = model.predict(X)         # 0 = benign, 1 = malicious
probs = model.predict_proba(X)   # calibrated malicious probability

From raw PCAP to prediction

The model expects flow-level features, not raw packets. Convert PCAPs first with CICFlowMeter:

bash

cicflowmeter -f suspicious.pcap -c flows.csv
python3 load_pretrained.py flows.csv   # helper script in the GitHub repo

Feature schema

Standard CICFlowMeter feature set — flow duration, forward/backward packet counts and byte totals, packet-length distributions, inter-arrival-time statistics, TCP flag counts, active/idle timings, etc. The full ordered feature list is embedded in cicids_catboost.json (also included in this repo).

Intended use

Defensive-security research and blue-team tooling
Educational demonstrations of ML applied to intrusion detection
Baseline for CIC-IDS-2017 benchmarking

Out of scope

Live packet inspection without a CICFlowMeter-equivalent flow aggregator
Attack families not represented in CIC-IDS-2017 (modern C2 frameworks, encrypted-tunnel exfiltration, zero-days)
Any deployment without independent validation on your own network's traffic

Training details

Framework: CatBoost 1.2+
Hardware: Google Colab (CPU runtime)
Split: 70 / 30 stratified train / test
Iterations: 500 with early_stopping_rounds=50
Learning rate: 0.05
Depth: 6

License

MIT — see the source repository.

Citation

bibtex

@misc{pcap_ml_traffic_classifier_2026,
  author       = {pop123-ux},
  title        = {pcap-ml-traffic-classifier: CatBoost-Powered Network Intrusion Detection},
  year         = {2026},
  publisher    = {GitHub},
  howpublished = {\url{https://github.com/pop123-ux/pcap-ml-traffic-classifier}}
}