Reproducibility package for: Predictive Inversion in Cross-Network Intrusion Detection

Reproducibility package for the manuscript "Predictive Inversion in Cross-Network Intrusion Detection: Which Flows to Label When Confidence Cannot Be Trusted" (submitted to the Journal of Network and Systems Management). This repository contains the experimental results and analysis code needed to reproduce every figure, table, and statistical claim reported in the manuscript. A network intrusion detector trained on one network can have its score ordering invert on another network (target AUROC below 0.5), even when the same detector scores near 0.99 in-domain. We study which label-acquisition strategy safely repairs such a detector using only a small number of target labels, across six directed source→target transfers, four label budgets, three classifier families, and 18 seeds. Contents: data/results.csv — raw experimental results (1,836 rows: 6 directed pairs × 4 acquisition strategies × 4 label budgets × 18 seeds, plus no-adaptation baselines) scripts/run_experiment.py — the original leakage-free experiment pipeline that produced results.csv scripts/statistical_analysis.py — paired Wilcoxon signed-rank significance analysis reproducing all statistics quoted in the manuscript The source NetFlow-v2 benchmark datasets (Sarhan, Layeghy & Portmann, 2022) are not redistributed here; download instructions are given in the README.