DRES-NID-RFE10: a curated & augmented network-traffic anomaly-detection dataset on the RFE-10 schema (NSL-KDD)

A curated derivative of NSL-KDD for binary network-traffic anomaly detection on exactly the 10 RFE-selected features used in the author's article (Shapovalova, Matyakh & Titov, 2024): ProtocolType, Flag, SrcBytes, DstBytes, Count, SameSrvRate, DiffSrvRate, DstHostSrvCount, DstHostSameSrvRate, DstHostSameSrcPortRate. This is a task-tied (not country-specific) benchmark - it reproduces the article's exact dataset and method. Two aligned versions: base_v1 (the 10 raw RFE features, label-encoded) and improved_v2 (feature engineering + one-hot + robust scaling + SMOTE class balancing). Trained on KDDTrain+ and evaluated on the out-of-distribution KDDTest+ (which holds attack types absent from training - a stand-in for the article's test->working-mode gap): engineering + balancing lift 4 of 5 models (best GBM F1 0.751 / ROC-AUC 0.952; MLP gains most, F1 0.693->0.738), with KNN slightly down (reported honestly). Source: NSL-KDD (Tavallaee et al., 2009), used under its derivative-permitting terms with citation. Not Ukraine-specific - this is a generic IDS benchmark tied to the article's task.