Research
Why machine-learning intrusion detectors fail outside the lab
At Sakarya University's CyberSense Laboratory I study what intrusion-detection models actually learn — and why a model that looks perfect on a benchmark can be close to useless on machines it has never seen.
The system
A machine-learning DDoS detector that runs inside the Snort 3 intrusion-detection engine on a 1 Gb/s lab test bench and decides from the first two packets of a connection. The model is trained with XGBoost and served with ONNX Runtime, on 1.19 million connections the team labelled from raw packet captures (CSE-CIC-IDS2018).
My part is the model science: the dataset, the validation, and the investigation below. I did not write the C++ inspector that runs the model inside Snort.
What I found
The model scored a near-perfect ROC-AUC of 0.99999. I showed that the score came from recognising the attacked server, not the attack: one setting of the victim server appeared in almost every attack connection, and the model had learned that fingerprint.
| Measurement | Result |
|---|---|
| Attack connections carrying one victim-server TCP window value | 99.74% |
| ROC-AUC with the victim fingerprints, then without them (two variants) | 0.99999 → 0.779 / 0.758 |
| False-alarm rate on 20 machines the model never saw, before → after | 0.037% → 47–52% |
| Correlation between a machine's false-alarm rate and the share of one fingerprint value | r = 1.000 |
Removing one fingerprint does not make the model fail cleanly: it switches to the next feature that identifies the victim. Evaluating on machines held out from training (host-disjoint evaluation) is what exposes this.
Paper in preparation
“What a First-Packet DDoS Detector Really Learns — Missing-Feature Skew and Victim Fingerprints in Early-Flow Intrusion Detection.”
The paper combines packet-2 detection, host-disjoint evaluation and an in-sensor deployment on a lab bench — a combination we did not find in prior work — to measure train/serve missing-value skew and shortcut substitution, and proposes an evaluation checklist for early-flow machine-learning intrusion detection.
TÜBİTAK 2209-A proposal
Prompt-injection detection in Turkish web text — a separate team project (proposal, 2026). It compares rule-based, TF-IDF and transformer defences, and measures how Turkish morphology, spelling variation and Turkish–English code-switching affect detection, using attack-family-disjoint splits, hard negatives and McNemar tests.
For research groups: I am looking for an Erasmus+ research traineeship in machine-learning security for summer 2027. Funding comes from the Erasmus+ programme, so there is no cost to the host group.