The KDD Cup dataset is a large labeled collection of network connections for intrusion and outlier detection. Each record represents a connection composed of packets exchanged between a sender and host, with 41 features describing duration, protocol, service, byte counts, login activity, file operations, and connection errors. The target is either normal or one of 24 attack types, which can be grouped into a single nonnormal class for binary outlier detection. section 5.2.1
Its practical characteristics shape how detectors are trained and assessed:
- Contains about 4.8 million rows, so scikit-learn provides subsets; many examples use only three or four features. section 5.2.1
- Is extremely imbalanced: approximately 99.7% of records are normal, with the remainder representing network attacks. section 5.2.1
- Serves as a frequently used baseline because outlier detectors can solve the task, although flagged records still require interpretation. section 5.2.1 section 5.2.2
Isolation Forest on the SA subset
Fetch the SA subset, convert the normal label to 0 and attacks to 1, encode its three categorical columns with OrdinalEncoder, and fit IsolationForest without feature scaling. Use predict() for binary labels, score_samples() for continuous scores, and AUROC to compare score rankings with the ground truth. The example reports AUROC near 0.95, varying roughly from 0.93 to 0.98 without a fixed random seed; fitting only on clean normal data raises it to about 0.98 in this demonstration. section 5.2.2
