IP Composition Analysis as a Prerequisite for IDS Dataset Evaluation: Correcting File-Level Label Artifacts in SDN-MG25

Intrusion detection system (IDS) research relies on accurately labeled network traffic datasets; however, label quality in IDS datasets is seldom audited prior to modeling. Many publicly available IDS datasets assign ground-truth labels based on capture filenames or temporal session windows rather than per-flow inspection, a practice referred to as file-level labeling. This study identifies and corrects a systematic mislabeling instance in SDN-MG25, a CICFlowMeter-based dataset for software-defined networking (SDN)-enabled microgrid intrusion detection. IP composition analysis, which cross-references each attack-labeled flow with the documented attacker IP address, reveals that the BackgroundAttackTraffic (BAT) class, comprising 3167 flows (79.5% of all attack labels), contains no attacker-originated traffic. All BAT flows involve legitimate microgrid hosts communicating with external services during the attack capture window. Correcting this labeling error increases binary detection F1 from 0.578 to 0.956±0.005, an improvement of +0.378 that is 4.2 times greater than the best single modeling improvement (threshold tuning, +0.090). Furthermore, Confident Learning, a state-of-the-art automated label-noise detector, recovers only 8.4% of mislabeled BAT flows (recall =0.084, precision =0.247), indicating that domain-knowledge audits are essential for detecting systematic, class-level mislabeling that statistical methods cannot identify. The end-to-end pipeline Macro F1 improves from 0.749 to 0.862 after label correction. IP composition analysis is proposed as a mandatory prerequisite for IDS dataset evaluation, and a reproducible two-stage pipeline with feature-tier ablation for session confound diagnosis is provided.