KNOWML: Improving Generalization of ML-NIDS with Attack Knowledge Graphs

This repository contains the code for our Euro S&P 2026 paper:

KNOWML: Improving Generalization of ML-NIDS with Attack Knowledge Graphs

Repository Structure

The repository is organized as follows:

• Feature_extraction/ Contains the code for feature extraction.

• KG_construction/ Contains the code for attack knowledge graph construction.

Dataset

The dataset used in this work is too large to be shared directly through this repository. We are currently figuring out the best way to make it available.

In the meantime, any questions can be sent to:

x.guo23@imperial.ac.uk