Supplementary material for: Ranked Well, Detected Rarely: A Per-Label Audit of Random Forest Transfer from CIC-IDS2017 to CSE-CIC-IDS2018 and CIC-DDoS2019

Contents File or folder Content Supplementary_Tables_S1-S3.xlsx Table S1: the 77 mapped features with their CSE-CIC-IDS2018 names and feature groups. Table S2: attack-label composition of the CIC-IDS2017 training samples (seeds 42 to 44). Table S3: per-file results on CSE-CIC-IDS2018 (primary model, seed 42, threshold 0.5). Supplementary_File_S1_dataset_SHA256.csv SHA256 checksums and sizes of the 25 dataset CSV files used (8 CIC-IDS2017, 10 CSE-CIC-IDS2018, 7 CIC-DDoS2019 day 03-11). EXPERIMENT_PLAN_v1.md Feature-group ablation plan, frozen 2026-10-22 17:25:59 (UTC+8). SHA256 ACACF79CA9A1AB98180AEB970C1D854FDD845E0CBB117E52B3A7A1C9DAA89F69. EXPERIMENT_PLAN_CIC19_v1.md CIC-DDoS2019 confirmatory plan, frozen 2026-10-25 18:26:04 (UTC+8). SHA256 FD0A308F0DE04DD94923A6159C0863816BD20FC626D415CDA2B27403DE53668F. code_v1.zip Python scripts for preprocessing, training, evaluation, ablation, post-hoc score analysis, label-free feature checks, training-composition reconstruction and figures. results_summary.zip Summary result files from which the tables and figures were computed. They hold metrics and counts only, no network flows. Not included The CIC-IDS2017, CSE-CIC-IDS2018 and CIC-DDoS2019 datasets are not redistributed here. They are available from the Canadian Institute for Cybersecurity, University of New Brunswick (https://www.unb.ca/cic/datasets/). The checksums in Supplementary File S1 show whether a downloaded copy matches the files used.