IDSLab: A Low-Code Platform for End-to-End IDS Dataset Construction and Experimentation

Developing machine learning-based intrusion detection systems (IDS) remains a fragmented and engineering-intensive process, often relying on ad-hoc pipelines for data collection, preprocessing, labeling, and experimentation. Moreover, most existing IDS datasets focus primarily on network-level data, despite growing evidence that combining heterogeneous sources can improve detection robustness. We present IDSLab, a low-code experimental platform designed to support data-centric IDS research and prototyping. IDSLab integrates environment management, adversary simulation, scalable multi-source data collection, and graph-based dataset construction within a single extensible framework, exposed through an interactive graphical interface. We describe the architecture and implementation of IDSLab and demonstrate its utility through an end-to-end use case involving dataset construction and ML-based DoS detection in a Kubernetes environment.