一句话：提出低代码平台 IDSLab，集成环境管理、对手模拟、多源采集与图数据集构建，支持端到端 IDS 实验。
基于机器学习的入侵检测系统开发流程碎片化且工程密集，常依赖临时流水线完成数据采集、预处理、标注与实验；现有 IDS 数据集又多局限于网络层数据，难以融合异构来源。本文提出低代码实验平台 IDSLab，面向以数据为中心的 IDS 研究与原型开发，将环境管理、对手模拟、可扩展多源数据采集以及基于图的数据集构建集成在统一可扩展框架中，并通过交互式图形界面暴露给用户。作者介绍其架构与实现，并以 Kubernetes 环境中的端到端用例展示如何构建数据集并执行基于 ML 的 DoS 检测，验证平台实用性。
Developing machine learning-based intrusion detection systems (IDS) remains a fragmented and engineering-intensive process, often relying on ad-hoc pipelines for data collection, preprocessing, labeling, and experimentation. Moreover, most existing IDS datasets focus primarily on network-level data, despite growing evidence that combining heterogeneous sources can improve detection robustness. We present IDSLab, a low-code experimental platform designed to support data-centric IDS research and prototyping. IDSLab integrates environment management, adversary simulation, scalable multi-source data collection, and graph-based dataset construction within a single extensible framework, exposed through an interactive graphical interface. We describe the architecture and implementation of IDSLab and demonstrate its utility through an end-to-end use case involving dataset construction and ML-based DoS detection in a Kubernetes environment.
@inproceedings{MorsliKOL26,
title = {IDSLab: A Low-Code Platform for End-to-End IDS Dataset Construction and Experimentation},
author = {Reda Morsli and Nadjia Kara and Hakima Ould-Slimane and Laaziz Lahlou},
booktitle = {FSE},
year = {2026},
doi = {10.1145/3803437.3806411}
}