IDSLab
A framework for building and evaluating staged (cascade) network intrusion detection systems. You describe a design in one YAML file, or draw it in the dashboard: the stages, the model in each, and where each stage sends the flows it judges. IDSLab fits it, makes every choice on validation data, and then shows on untouched test data whether the design beats its own first stage alone, and what each stage adds.
Quickstart
IDSLab needs Python 3.10 or newer and installs from PyPI.
python3 -m venv .venv && .venv/bin/pip install idslab
.venv/bin/idslab example demo # synthetic data and three reference designs
.venv/bin/idslab run demo/r1_router_gate.yaml --out demo/runs # fit, choose on VAL, report on TEST
.venv/bin/idslab dashboard --workspace demo --open # optional web UI
On Windows, in PowerShell (the programs are in .venv\Scripts):
py -3.12 -m venv .venv; .\.venv\Scripts\pip install idslab
.\.venv\Scripts\idslab example demo
.\.venv\Scripts\idslab run demo\r1_router_gate.yaml --out demo\runs
.\.venv\Scripts\idslab dashboard --workspace demo --open # keep the window open; Ctrl+C stops it
The report is demo/runs/r1-router-gate/report.html. Step-by-step guides for Windows, macOS and
GNU/Linux, optional model libraries and troubleshooting are in
INSTALL.md.
Documentation
| Guide | What it covers |
|---|---|
| How it works | one run in figures: the design, the splits, the accuracy after each stage, the frontier gap and the flow map |
| Getting started | a first run on the synthetic data, reading the report, moving to your own data |
| Example designs | the three reference cascades with diagrams, a custom model adapter, an outside score job |
| Config reference | every key of a config file, with defaults |
| Protocol and controls | splits, greedy selection on VAL, the controls and what each reported number means |
| Models in stages | score contracts, pipelines and search, PyTorch, your own adapter, scores from models trained elsewhere |
| Outputs | the report pages and every file a run writes |
| Comparing designs and sweeps | two designs on the same flows, paired per seed; one base config with many variants |
| Command line | validate, run, report, export-splits, example, compare, sweep, dashboard |
| Dashboard | the local web UI: pages, jobs, security (source reference) |
| Architecture | what happens during a run, the modules, and where to extend |
| Known limitations | what the numbers do and do not show |
| Design notes | the reasoning behind each protocol rule |
| Install guide | platform setup, extras, tests and checks |
| Changelog | what changed in each version |
| Project site | the project's overview page |
Versions
Every release and its changes are in the changelog and on the Releases page. Releases from 0.3.0 on are archived on Zenodo under the concept DOI above. From 0.3.1 on, a release that does not change the evaluation keeps finished runs; upgrades to 0.2.0 and 0.3.0 ran them again.
v0.3.0: the dashboard redesigned around experiments, with a guided setup, a results page that reads the cascade against its first stage, and job progress.v0.2.0: visual pipeline builder, cost objectives and stage cost, plugins,idslab compareandidslab sweep.v0.1.0: first public release.
Citing
Cite the version you used. The concept DOI 10.5281/zenodo.23435536 always resolves to the latest version, and lists each version's own DOI and citation. CITATION.cff holds the same details, and GitHub shows them under "Cite this repository".
License
AGPL-3.0-or-later. See LICENSE.
1 maintainer
Metadata
1 maintainer
Release files for idslab 0.3.2
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| idslab-0.3.2.tar.gz | 1.0 MB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| idslab-0.3.2-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 1.2 MB
Release files / idslab-0.3.2.tar.gz
| Download URL | idslab-0.3.2.tar.gz |
|---|---|
| Size | 1.0 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
e71d09299c7ee5bf2754cb835c0781c16ad2764fbbbb86489f72e065f021a1a3
|
|
BLAKE2b-256 checksum How to use checksums |
f6bb38c82ac9d8cc21548c9119a5ead13efa0079519f054e4dd83abda9fbb203
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 17, 2026.
Transparency logRelease files / idslab-0.3.2-py3-none-any.whl
| Download URL | idslab-0.3.2-py3-none-any.whl |
|---|---|
| Size | 212.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
256c9843654d4a47ad9dcfc1d518bd05d8fd5763e6921c9326477f4f758eb15f
|
|
BLAKE2b-256 checksum How to use checksums |
c06ce6d96b9b5059b4f6b0ad521a41e35543f37f9258923d094d97804b609863
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 17, 2026.
Transparency log
