README: one-line descriptions of each baseline; figures: SVG export + label tweaks

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
2026-05-11 08:52:46 +08:00
parent 6f279bcf23
commit 402309c9a7
5 changed files with 420 additions and 6 deletions

View File

@@ -39,6 +39,21 @@ JANUS is fully unsupervised (benign-only training, no attack labels at any stage
Thresholded F1 metrics for JANUS across all four datasets are in `RESULTS.md` Section D. -->
### Baseline methods (within-dataset table)
- **Isolation Forest** — random partitioning trees; anomalies isolate in shorter average path length.
- **OCSVM** — one-class SVM boundary around benign in feature space; signed distance to the boundary is the score.
- **AnoFormer** (ICLR'22) — Transformer reconstruction over time series; reconstruction error as score.
- **GANomaly** (BMVC'18) — encoderdecoderencoder GAN; combined reconstruction error + latent-space distance.
- **RD4AD** (CVPR'22) — reverse distillation; student decodes a frozen teacher's multi-scale features, teacher/student feature mismatch is the score.
- **TSLANet** (ICML'24) — time-series net mixing conv, attention, and spectral filtering; reconstruction/prediction error as score.
- **ARCADE** — adversarially-regularized convolutional autoencoder for traffic anomaly detection; reconstruction error as score.
- **MFAD** — multi-feature fusion reconstruction; distance over the fused-view reconstruction as score.
- **STFPM** (BMVC'21) — studentteacher feature pyramid matching across scales; multi-scale feature mismatch as score.
- **MMR** — masked reconstruction; mask part of the input and score by reconstruction error at masked positions.
- **Shafir NF + Shapley** (arXiv'26) — Normalizing Flow on CICFlowMeter flow statistics with SHAP-selected top-5 features; negative log-likelihood as score.
- **ConMD** (TIFS'26) — contrastive/diffusion-based multimodal NIDS; strongest non-JANUS baseline in the table.
### 3×3 cross-dataset transfer matrix
Source (rows) trained on 10K benign of source dataset; target (columns) tested on full target benign + **all** target attacks. Aggregator fit on target benign val only — no attack labels at any stage. Diagonal italic = within-dataset.