Hi, I had this doubt too, and thought since there are more normal data than abnormal data, It takes less effort label the anomalous nodes.
And in the 9th page, the authors say: 'For DARPA TC datasets, we label the abnormal data by the
name of attack events in the groundtruth files'
So I'm considering the files in the ground truth directory mean the list of malicious nodes.
Hi, I had this doubt too, and thought since there are more normal data than abnormal data, It takes less effort label the anomalous nodes. And in the 9th page, the authors say: 'For DARPA TC datasets, we label the abnormal data by the name of attack events in the groundtruth files' So I'm considering the files in the ground truth directory mean the list of malicious nodes.