# Centralized dataset configuration for perdalam-protean.
#
# RAW DATA CONTRACT
#   The raw datasets live OUTSIDE this repository and are read-only source data.
#   They must never be moved, renamed, overwritten, or copied wholesale into the repo.
#
# PATH RESOLUTION PRECEDENCE (implemented in src/protean_research/utils/config.py)
#   1. per-dataset environment variable listed in `env_override`
#   2. `raw_path` below (`~` is expanded)
#   3. values are resolved at load time; nothing is hardcoded in training logic
#
# GENERATED DATA
#   All preprocessed caches, partitions, manifests, checkpoints and analysis
#   outputs must be written under `generated_root` (default: artifacts/), never
#   back into the raw dataset directory.
#
# PREPROCESSING CONTRACT (frozen 2026-09-24, see docs/research/EXPERIMENT_PROTOCOL.md)
#   * `categorical_columns` are one-hot encoded with categories fitted on the
#     TRAIN split only; an explicit "__MISSING__" category is added.
#   * every other feature column is coerced to numeric (missing tokens -> NaN),
#     median-imputed and standardized using TRAIN statistics only.
#   * `non_feature_columns`, the label column and its aliases are never features.

generated_root: artifacts

datasets:
  xiiotid:
    name: X-IIoTID
    raw_path: ~/datasets/X-IIoTID/X-IIoTID-dataset.csv
    env_override: PROTEAN_XIIOTID_RAW_PATH
    # Paper uses the 10 "general" attack classes and removes Crypto-ransomware.
    label_column: class2
    label_column_aliases:
      fine_grained: class1        # 19 specific attacks
      binary: class3              # Normal / Attack
    benign_label: Normal
    drop_labels:
      - crypto-ransomware
    # '-' is the dataset's documented missing placeholder, not an empty string.
    missing_tokens: ["-", "?", "#DIV/0!", "aza"]
    drop_duplicate_rows: true
    # Feature columns that must be treated as categorical (one-hot).
    categorical_columns:
      - Protocol
      - Service
      - anomaly_alert
    # Columns that are identifiers / timestamps / network endpoints and must NOT
    # be used as model features without an explicit, documented decision.
    non_feature_columns:
      - Date
      - Timestamp
      - Scr_IP
      - Scr_port
      - Des_IP
      - Des_port
    notes: >
      Row-level missing placeholders ('-') and a small number of malformed tokens
      (e.g. '?', 'aza', '#DIV/0!') exist. Exact duplicate rows are present. See
      docs/research/DATASET_INSPECTION.md.

  5gnidd:
    name: 5G-NIDD
    raw_path: ~/datasets/5G-NIDD/5G-NIDD.csv
    env_override: PROTEAN_5GNIDD_RAW_PATH
    # Multi-class attack label (9 values incl. Benign): the class used by PROTEAN.
    label_column: Attack Type
    label_column_aliases:
      binary: Label              # Malicious / Benign
      tool: Attack Tool
    benign_label: Benign
    drop_labels: []
    missing_tokens: [""]
    drop_duplicate_rows: true
    categorical_columns:
      - Proto
      - sDSb
      - dDSb
      - Cause
      - State
    # The first column is an unnamed row index. Seq / Offset are flow-ordering fields.
    non_feature_columns:
      - "Unnamed: 0"
      - Seq
      - Offset
    notes: >
      Several columns are missing for large row fractions (e.g. dTos, DstWin,
      sVid, dVid). See docs/research/DATASET_INSPECTION.md.