| name | bogus-data-helper |
| description | Helps create placeholder data (tables, figures, metrics) for evaluation sections with clear warnings that all numbers must be replaced with real experimental results. Also generates descriptions explaining what the data shows and how it supports the paper's claims and insights. |
Bogus Data Helper Skill
This skill helps create placeholder data for evaluation sections, including tables, figures, and metrics. It also generates descriptive text explaining what the data shows and how it supports the paper's claims. All generated data is clearly marked as synthetic and must be replaced with real experimental results.
When to Use This Skill
- User requests to add placeholder evaluation data (e.g., "add placeholder results", "create example table")
- User wants to see what kind of data structure is expected
- User needs to fill in evaluation section while waiting for real experiments
- User wants to understand the expected format and metrics
- User wants to understand how data should support their claims
Role and Responsibilities
You are an AI assistant helping create placeholder evaluation data. Your generated content must:
- Be clearly marked: All synthetic data must have warning markers
- Be realistic-looking: Structure should match what real data would look like
- Be informative: Show what kind of data is expected
- Include descriptions: Explain what the data shows
- Link to claims: Describe how data supports the paper's insight and arguments
- Not be real data: Never claim these are real results
- Be inserted directly: Content goes in paper.md as real text (not comments)
Paper Structure Reference
The paper follows CoPaper structure. Key rules for inserting placeholder content:
- Level 1 (
#): Paper title only.
- Level 2-5 (
## to #####): Structural headings only — do NOT modify these.
- Level 6 (
######): Content paragraphs. Title = topic sentence (≤50 chars). Body = supporting text (≤500 chars).
- Metadata: HTML comments
<!-- description: ... --> guide what each section should contain.
Do NOT read writingrules.md — the essential structure rules are inlined above.
Input Files
| File | Required | When to Read | Purpose |
|---|
paper.md | Required | Step 1 (understand evaluation section structure) | Identify evaluation sections, claims, metrics, and design decisions that need placeholder data |
storyline.md | Required | Step 1 (align with research narrative) | Align placeholder data with the paper's claimed insight and design decisions |
Do NOT read writingrules.md — the essential structure rules are inlined in the Paper Structure Reference above.
⚠️ CRITICAL WARNING
ALL DATA GENERATED BY THIS SKILL IS SYNTHETIC AND MUST BE REPLACED WITH REAL EXPERIMENTAL RESULTS.
- Do NOT submit papers with bogus data
- Do NOT use these numbers in actual publications
- Do NOT misrepresent synthetic data as real experiments
- These placeholders are ONLY for understanding expected structure while real experiments are being conducted
Bogus Data Markers
All synthetic data must be clearly marked with these markers:
For Numbers in Text
⚠️ [BOGUS DATA: X% - REPLACE WITH REAL RESULT]
For Tables
⚠️ TABLE CONTAINS BOGUS DATA - ALL NUMBERS ARE PLACEHOLDERS - REPLACE WITH REAL EXPERIMENTAL RESULTS
For Figures
⚠️ FIGURE PLACEHOLDER - REPLACE WITH ACTUAL EXPERIMENTAL PLOTS
For Statistical Results
⚠️ [BOGUS STATISTICS - p<0.01 IS PLACEHOLDER - REPLACE WITH ACTUAL STATISTICAL TESTS]
Types of Placeholder Data
1. Performance Comparison Tables with Descriptions
Standard format for comparing your method with baselines:
⚠️ TABLE CONTAINS BOGUS DATA - ALL NUMBERS ARE PLACEHOLDERS - REPLACE WITH REAL EXPERIMENTAL RESULTS
**Table X: Overall Performance Comparison**
| Method | Detection Rate (%) | False Positive Rate (%) | MTTD (hours) | Attack Chain Accuracy (%) |
|--------|-------------------|------------------------|--------------|--------------------------|
| Snort | ⚠️ [BOGUS: 45.2%] | ⚠️ [BOGUS: 15.3%] | ⚠️ [BOGUS: 72.4] | ⚠️ [BOGUS: N/A] |
| OSSEC | ⚠️ [BOGUS: 52.8%] | ⚠️ [BOGUS: 12.7%] | ⚠️ [BOGUS: 68.1] | ⚠️ [BOGUS: N/A] |
| Random Forest | ⚠️ [BOGUS: 68.4%] | ⚠️ [BOGUS: 9.2%] | ⚠️ [BOGUS: 45.3] | ⚠️ [BOGUS: N/A] |
| LSTM | ⚠️ [BOGUS: 72.1%] | ⚠️ [BOGUS: 7.8%] | ⚠️ [BOGUS: 38.6] | ⚠️ [BOGUS: 58.3%] |
| HOLMES | ⚠️ [BOGUS: 78.3%] | ⚠️ [BOGUS: 8.5%] | ⚠️ [BOGUS: 48.2] | ⚠️ [BOGUS: 71.2%] |
| RAPID | ⚠️ [BOGUS: 75.6%] | ⚠️ [BOGUS: 6.9%] | ⚠️ [BOGUS: 32.4] | ⚠️ [BOGUS: 64.8%] |
| **Our Method** | ⚠️ [BOGUS: 92.1%] | ⚠️ [BOGUS: 2.1%] | ⚠️ [BOGUS: 12.3] | ⚠️ [BOGUS: 87.5%] |
All results averaged over ⚠️ [BOGUS: 5] runs with different random seeds.
Statistical significance: All improvements are significant (⚠️ [BOGUS: p < 0.01, paired t-test]).
---
###### 数据解读
表格展示了不同方法在APT攻击数据集上的整体性能对比。本方法在所有关键指标上均显著优于现有方法。
从数据中可以观察到三个关键趋势：
1. **传统检测方法的局限性**：基于规则的检测（Snort, OSSEC）检测率低于60%，误报率超过10%，表明传统方法难以应对复杂的多阶段APT攻击。
2. **机器学习方法的改进与瓶颈**：机器学习方法（RF, LSTM）相比传统方法有明显提升，检测率达到⚠️ [BOGUS: 68-72%]，但仍受限于独立事件检测的局限，无法捕捉攻击的时序关联特征。
3. **攻击链检测方法的优势**：攻击链检测方法（HOLMES, RAPID）通过考虑攻击阶段关联，检测率提升至⚠️ [BOGUS: 75-78%]，验证了时序建模的有效性。但它们的固定转移概率和离线处理方式限制了进一步改进。
4. **本方法的显著优势**：本方法在所有指标上均达到最优，检测率达到⚠️ [BOGUS: 92.1%]，误报率降至⚠️ [BOGUS: 2.1%]，MTTD缩短至⚠️ [BOGUS: 12.3小时]。
---
###### 如何支持论点
此数据从多个维度支持本文的核心主张：
**对核心Insight的支持**:
- 核心Insight主张"时序关联特性对APT检测至关重要"
- 数据显示：包含时序建模的方法（HOLMES, RAPID, Ours）平均检测率⚠️ [BOGUS: 82%]，显著高于不包含的方法（Snort, OSSEC, RF, LSTM）平均⚠️ [BOGUS: 60%]
- 这验证了时序关联建模的有效性
**对设计决策的验证**:
- **时序图神经网络**：本方法相比LSTM提升⚠️ [BOGUS: 20%]检测率，说明图结构建模比序列建模更适合攻击链
- **自适应转移概率**：本方法相比HOLMES（固定转移）提升⚠️ [BOGUS: 14%]检测率，验证了自适应设计的必要性
- **实时图构建**：MTTD仅⚠️ [BOGUS: 12.3小时]，相比RAPID（⚠️ [BOGUS: 32.4小时]）缩短⚠️ [BOGUS: 62%]，验证了实时处理的价值
**性能提升的量化**:
- 相比最优基线HOLMES，检测率提升⚠️ [BOGUS: 17.6%]（相对提升⚠️ [BOGUS: 22.5%]）
- 误报率降低⚠️ [BOGUS: 75.3%]
- 检测时间缩短⚠️ [BOGUS: 74.5%]
- 所有提升均通过统计显著性检验（⚠️ [BOGUS: p < 0.01]）
2. Ablation Study Tables with Descriptions
⚠️ TABLE CONTAINS BOGUS DATA - ALL NUMBERS ARE PLACEHOLDERS - REPLACE WITH REAL EXPERIMENTAL RESULTS
**Table Y: Ablation Study Results**
| Variant | Detection Rate (%) | FPR (%) | Notes |
|---------|-------------------|---------|-------|
| Full Method | ⚠️ [BOGUS: 92.1%] | ⚠️ [BOGUS: 2.1%] | Complete system |
| w/o Temporal Modeling | ⚠️ [BOGUS: 76.4%] | ⚠️ [BOGUS: 5.8%] | Remove temporal GNN |
| w/o Attack Chain Graph | ⚠️ [BOGUS: 81.2%] | ⚠️ [BOGUS: 4.2%] | Use flat classification |
| w/o Adaptive Transfer | ⚠️ [BOGUS: 85.7%] | ⚠️ [BOGUS: 3.5%] | Fixed transition probabilities |
| w/o Real-time Construction | ⚠️ [BOGUS: 88.9%] | ⚠️ [BOGUS: 2.8%] | Batch processing only |
---
###### 数据解读
消融实验系统性地评估了每个设计组件对整体性能的贡献。通过逐个移除关键组件，量化了各组件的重要性。
从消融结果可以观察到：
1. **时序建模是核心组件**：移除时序图神经网络导致检测率下降⚠️ [BOGUS: 15.7%]（从⚠️ [BOGUS: 92.1%]降至⚠️ [BOGUS: 76.4%]），误报率上升⚠️ [BOGUS: 176%]，表明时序关联建模是本方法的关键创新。
2. **图结构建模的重要性**：移除攻击链图结构（改用扁平分类）导致检测率下降⚠️ [BOGUS: 10.9%]，说明攻击阶段间的关联关系对检测至关重要。
3. **自适应转移的价值**：使用固定转移概率（移除自适应转移）导致检测率下降⚠️ [BOGUS: 6.4%]，表明动态调整转移概率能有效适应不同攻击模式。
4. **实时构建的贡献**：虽然实时图构建对检测率影响较小（下降⚠️ [BOGUS: 3.2%]），但对实际部署至关重要，确保检测延迟满足实时性要求。
---
###### 如何支持论点
消融实验从以下方面支持本文的设计决策：
**验证设计决策的必要性**:
- **设计决策1（时序图神经网络）**：移除后性能下降最显著（⚠️ [BOGUS: -15.7%]），验证了这是最重要的设计创新
- **设计决策2（攻击链图结构）**：移除后性能下降⚠️ [BOGUS: -10.9%]，验证了图结构建模比独立检测更有效
- **设计决策3（自适应转移）**：移除后性能下降⚠️ [BOGUS: -6.4%]，验证了自适应机制优于固定规则
- **设计决策4（实时构建）**：移除后延迟增加⚠️ [BOGUS: 5倍]，验证了实时处理对实际部署的价值
**量化各组件的贡献度**:
- 时序建模：贡献⚠️ [BOGUS: 15.7%]检测率提升 → 最关键
- 图结构：贡献⚠️ [BOGUS: 10.9%]检测率提升 → 重要
- 自适应：贡献⚠️ [BOGUS: 6.4%]检测率提升 → 有价值
- 实时性：贡献⚠️ [BOGUS: 80%]延迟降低 → 实用性强
**排除简单方案的可能性**:
- 如果移除时序建模后性能下降不大，说明时序建模不必要
- 实验结果显示显著下降，证明不能简化设计
- 验证了设计复杂性的合理性
3. Parameter Sensitivity Tables
⚠️ TABLE CONTAINS BOGUS DATA - ALL NUMBERS ARE PLACEHOLDERS - REPLACE WITH REAL EXPERIMENTAL RESULTS
**Table Z: Sensitivity to Window Size**
| Window Size (seconds) | Detection Rate (%) | FPR (%) | Processing Time (ms) |
|-----------------------|-------------------|---------|---------------------|
| 30 | ⚠️ [BOGUS: 85.3%] | ⚠️ [BOGUS: 3.4%] | ⚠️ [BOGUS: 45.2] |
| 45 | ⚠️ [BOGUS: 88.7%] | ⚠️ [BOGUS: 2.8%] | ⚠️ [BOGUS: 67.3] |
| **60** | ⚠️ [BOGUS: 92.1%] | ⚠️ [BOGUS: 2.1%] | ⚠️ [BOGUS: 89.4] |
| 75 | ⚠️ [BOGUS: 91.8%] | ⚠️ [BOGUS: 2.0%] | ⚠️ [BOGUS: 112.5] |
| 90 | ⚠️ [BOGUS: 90.5%] | ⚠️ [BOGUS: 1.9%] | ⚠️ [BOGUS: 145.6] |
| 120 | ⚠️ [BOGUS: 87.2%] | ⚠️ [BOGUS: 1.8%] | ⚠️ [BOGUS: 198.7] |
Optimal window size: 60 seconds (bold). Larger windows increase latency without improving detection.
4. Cross-Dataset Generalization Tables
⚠️ TABLE CONTAINS BOGUS DATA - ALL NUMBERS ARE PLACEHOLDERS - REPLACE WITH REAL EXPERIMENTAL RESULTS
**Table W: Cross-Dataset Evaluation**
| Training Dataset | Test Dataset | Detection Rate (%) | FPR (%) |
|-----------------|--------------|-------------------|---------|
| DARPA | DARPA | ⚠️ [BOGUS: 92.1%] | ⚠️ [BOGUS: 2.1%] |
| DARPA | Real-World APT | ⚠️ [BOGUS: 86.4%] | ⚠️ [BOGUS: 3.8%] |
| Real-World APT | Real-World APT | ⚠️ [BOGUS: 94.3%] | ⚠️ [BOGUS: 1.9%] |
| Real-World APT | DARPA | ⚠️ [BOGUS: 88.7%] | ⚠️ [BOGUS: 3.2%] |
| Combined | DARPA | ⚠️ [BOGUS: 91.5%] | ⚠️ [BOGUS: 2.4%] |
| Combined | Real-World APT | ⚠️ [BOGUS: 93.8%] | ⚠️ [BOGUS: 2.0%] |
Model generalizes well across datasets, especially when trained on combined data.
5. Scalability Results
⚠️ TABLE CONTAINS BOGUS DATA - ALL NUMBERS ARE PLACEHOLDERS - REPLACE WITH REAL EXPERIMENTAL RESULTS
**Table V: Scalability Analysis**
| Network Size (hosts) | Throughput (logs/sec) | Latency (ms) | Memory (GB) | CPU Utilization (%) |
|---------------------|----------------------|--------------|-------------|-------------------|
| 1,000 | ⚠️ [BOGUS: 125,000] | ⚠️ [BOGUS: 12.3] | ⚠️ [BOGUS: 2.4] | ⚠️ [BOGUS: 15.2] |
| 5,000 | ⚠️ [BOGUS: 485,000] | ⚠️ [BOGUS: 18.7] | ⚠️ [BOGUS: 8.6] | ⚠️ [BOGUS: 42.8] |
| 10,000 | ⚠️ [BOGUS: 892,000] | ⚠️ [BOGUS: 25.4] | ⚠️ [BOGUS: 15.3] | ⚠️ [BOGUS: 68.4] |
| 20,000 | ⚠️ [BOGUS: 1,650,000] | ⚠️ [BOGUS: 38.2] | ⚠️ [BOGUS: 28.7] | ⚠️ [BOGUS: 85.6] |
| 50,000 | ⚠️ [BOGUS: 3,840,000] | ⚠️ [BOGUS: 67.5] | ⚠️ [BOGUS: 62.4] | ⚠️ [BOGUS: 92.3] |
System scales near-linearly with network size.
6. Result Descriptions with Bogus Numbers
在APT攻击案例数据集上，本方法的检测率达到⚠️ [BOGUS: 92.1% - REPLACE WITH REAL RESULT]，相比最优基线HOLMES（⚠️ [BOGUS: 78.3%]）提升⚠️ [BOGUS: 17.6%]；误报率降至⚠️ [BOGUS: 2.1% - REPLACE WITH REAL RESULT]，相比HOLMES（⚠️ [BOGUS: 8.5%]）降低⚠️ [BOGUS: 75.3%]；MTTD缩短至平均⚠️ [BOGUS: 12.3小时 - REPLACE WITH REAL RESULT]，相比HOLMES（⚠️ [BOGUS: 48.2小时]）缩短⚠️ [BOGUS: 74.5%]。所有提升均通过显著性检验（⚠️ [BOGUS: p<0.01, paired t-test - REPLACE WITH ACTUAL STATISTICS]）。
7. Figure Placeholders
⚠️ FIGURE PLACEHOLDER - REPLACE WITH ACTUAL EXPERIMENTAL PLOTS
**Figure X: Detection Rate Comparison Across Methods**
[PLACEHOLDER FOR BAR CHART]
- X-axis: Methods (Snort, OSSEC, RF, LSTM, HOLMES, RAPID, Ours)
- Y-axis: Detection Rate (%)
- Shows: Our method achieves highest detection rate
- Include: Error bars showing standard deviation
- Caption: "Detection rate comparison across different methods on APT dataset. Our method achieves ⚠️ [BOGUS: 92.1%] detection rate, significantly outperforming all baselines."
**REPLACE WITH**: Generate actual bar chart using matplotlib/ggplot with real experimental data.
---
⚠️ FIGURE PLACEHOLDER - REPLACE WITH ACTUAL EXPERIMENTAL PLOTS
**Figure Y: Detection Rate vs. Window Size**
[PLACEHOLDER FOR LINE CHART]
- X-axis: Window Size (seconds): 30, 45, 60, 75, 90, 120
- Y-axis: Detection Rate (%)
- Shows: Performance peaks around 60 seconds
- Include: Confidence interval shading
- Caption: "Sensitivity analysis of window size. Detection rate peaks at ⚠️ [BOGUS: 60 seconds] with ⚠️ [BOGUS: 92.1%] accuracy."
**REPLACE WITH**: Generate actual line chart with real sensitivity analysis data.
---
⚠️ FIGURE PLACEHOLDER - REPLACE WITH ACTUAL EXPERIMENTAL PLOTS
**Figure Z: ROC Curve Comparison**
[PLACEHOLDER FOR ROC CURVES]
- X-axis: False Positive Rate (0 to 1)
- Y-axis: True Positive Rate (0 to 1)
- Lines: One curve for each method
- Shows: Our method has larger AUC
- Caption: "ROC curves for different methods. Our method achieves AUC of ⚠️ [BOGUS: 0.96], compared to HOLMES (⚠️ [BOGUS: 0.84]) and LSTM (⚠️ [BOGUS: 0.78])."
**REPLACE WITH**: Generate actual ROC curves from classification results.
8. Statistical Results
**Statistical Analysis:**
We performed paired t-tests to evaluate statistical significance:
- Detection Rate improvement: ⚠️ [BOGUS: t(49) = 8.32, p < 0.001, Cohen's d = 1.24]
- FPR reduction: ⚠️ [BOGUS: t(49) = -6.87, p < 0.001, Cohen's d = -0.98]
- MTTD reduction: ⚠️ [BOGUS: t(49) = -12.45, p < 0.001, Cohen's d = -1.76]
95% Confidence Intervals:
- DR improvement: ⚠️ [BOGUS: [14.2%, 21.0%]]
- FPR reduction: ⚠️ [BOGUS: [-7.8%, -5.0%]]
- MTTD reduction: ⚠️ [BOGUS: [-42.1, -29.7] hours]
⚠️ ALL STATISTICAL RESULTS ARE BOGUS - REPLACE WITH ACTUAL STATISTICAL TESTS FROM YOUR EXPERIMENTS
Workflow
Step 1: Understand Paper Claims
From paper.md:
- Identify the core insight: What is the main claim?
- Identify key design decisions: What are the main components?
- Identify what needs validation: What claims need experimental support?
- Note the evaluation metrics: What metrics are mentioned?
Example:
Core Insight: "Temporal correlation patterns in attack behavior are critical for APT detection"
Key Design Decisions:
1. Temporal GNN for modeling attack sequences
2. Adaptive state transition for dynamic behavior
3. Real-time graph construction
Claims to Validate:
1. Temporal modeling improves detection
2. Adaptive transitions outperform fixed transitions
3. System works in real-time
4. Method generalizes across different attack types
Step 2: Determine What Data Is Needed
Based on the claims, determine what experimental results are needed:
| Claim | Data Needed |
|---|
| "Temporal modeling improves detection" | Ablation: w/o vs with temporal component |
| "Outperforms baselines" | Comparison table with baseline methods |
| "Real-time processing" | Latency/throughput metrics |
| "Generalizes well" | Cross-dataset evaluation |
Step 3: Generate Placeholder Data
For each needed data type:
- Create the table/figure structure
- Add realistic-looking numbers
- Mark ALL bogus data with ⚠️
- Generate descriptive text (see Step 4)
- Link to claims (see Step 5)
Step 4: Generate Data Descriptions
For each table/figure, generate descriptive text explaining:
What the data shows:
###### 数据解读
表格展示了不同方法在APT攻击数据集上的性能对比。本方法在检测率、误报率和检测时间三个关键指标上均显著优于基线方法。
Key observations:
从数据中可以观察到：
1. 传统方法（Snort, OSSEC）检测率较低（<60%），表明基于规则的检测无法应对复杂APT攻击
2. 机器学习方法（RF, LSTM）有所改进，但仍受限于独立检测的局限
3. 攻击链检测方法（HOLMES, RAPID）性能更好，验证了时序关联的重要性
4. 本方法达到最高性能，验证了核心insight的正确性
Step 5: Link Data to Claims
For each result, explain how it supports the paper's arguments:
Format:
###### 如何支持论点
此数据从以下方面支持本文的核心主张：
**对核心Insight的支持**:
- 核心Insight主张"时序关联特性对APT检测至关重要"
- 数据显示：包含时序建模的方法（HOLMES, RAPID, Ours）检测率显著高于不包含的方法（Snort, RF）
- ⚠️ [BOGUS数据中: Ours比LSTM高XX%，比RF高XX%，证明时序建模的贡献]
**对设计决策的验证**:
- 设计决策1（时序图神经网络）：消融实验中移除该组件导致性能下降⚠️ [BOGUS: XX%]
- 设计决策2（自适应转移）：相比固定转移概率提升⚠️ [BOGUS: XX%]
- 设计决策3（实时构建）：系统延迟保持在⚠️ [BOGUS: <1秒]，满足实时性要求
**对相关工作的超越**:
- 相比最新工作HOLMES，检测率提升⚠️ [BOGUS: XX%]，误报率降低⚠️ [BOGUS: XX%]
- 验证了本文方法在时序建模上的创新性
Step 6: Insert into paper.md
Insert the generated content directly into paper.md:
- Table/figure with data
- Descriptive text explaining what data shows
- Text linking data to claims
- All with clear ⚠️ markers for bogus data
Step 7: Provide Guidance
After inserting placeholders:
- Explain what each table/figure shows
- Describe what real data should demonstrate
- Provide tips for generating real data
- Remind to remove all warning markers after replacing with real data
Important Guidelines
Three Elements of Placeholder Data
Every placeholder data block should contain three elements:
Element 1: Data (Table/Figure)
The actual numbers with clear ⚠️ markers:
⚠️ TABLE CONTAINS BOGUS DATA - ALL NUMBERS ARE PLACEHOLDERS
| Method | Accuracy |
|--------|----------|
| Baseline | ⚠️ [BOGUS: 75%] |
| Ours | ⚠️ [BOGUS: 92%] |
Element 2: Data Description
Explain what the data shows:
###### 数据解读
表格展示了不同方法的准确率对比。本方法达到最高准确率，相比基线提升⚠️ [BOGUS: 17%]。
从数据中可以观察到：
1. 基线方法准确率较低，说明需要改进
2. 本方法显著提升，验证了设计的有效性
Element 3: Link to Claims
Explain how data supports the paper's arguments:
###### 如何支持论点
此数据支持本文的核心主张：
**对核心Insight的支持**:
- Insight主张"X很重要"
- 数据显示：包含X的方法比不包含的方法性能高⚠️ [BOGUS: XX%]
- 验证了Insight的正确性
**对设计决策的验证**:
- 设计决策Y导致性能提升⚠️ [BOGUS: XX%]
- 验证了设计决策的必要性
DO:
- ✅ Make placeholder structure realistic
- ✅ Use appropriate metric ranges for the domain
- ✅ Show expected number format and precision
- ✅ Include all necessary columns/rows
- ✅ Mark EVERY bogus number with ⚠️
- ✅ Include data descriptions
- ✅ Link data to claims and insights
- ✅ Tell user what to replace with real experiments
DON'T:
- ❌ Claim these are real results
- ❌ Use these in actual publications
- ❌ Submit papers with placeholder data
- ❌ Forget to mark bogus data
- ❌ Make numbers unrealistic (e.g., 100% accuracy)
- ❌ Omit warning markers
- ❌ Just provide data without descriptions
- ❌ Forget to link data to paper's arguments
Realistic Number Ranges
For security/ML papers, use these realistic ranges:
| Metric | Typical Range | Bogus Example |
|---|
| Detection Rate | 60-95% | 85-92% |
| False Positive Rate | 1-15% | 2-8% |
| Accuracy | 70-98% | 85-95% |
| Precision | 60-95% | 80-90% |
| Recall | 60-95% | 85-92% |
| F1-Score | 0.6-0.95 | 0.85-0.92 |
| AUC | 0.7-0.98 | 0.88-0.96 |
| Processing Time | Problem-dependent | Vary by scale |
| Latency | Problem-dependent | Vary by system |
| p-value | < 0.05 for significance | 0.001-0.04 |
Example: Complete Evaluation Section with Placeholders
### 实验结果
#### 实验结果1: 整体性能对比
⚠️ TABLE CONTAINS BOGUS DATA - ALL NUMBERS ARE PLACEHOLDERS - REPLACE WITH REAL EXPERIMENTAL RESULTS
**Table 1: Overall Performance Comparison on APT Dataset**
| Method | DR (%) | FPR (%) | MTTD (hrs) | Chain Accuracy (%) |
|--------|--------|---------|------------|-------------------|
| Snort | ⚠️ [BOGUS: 45.2] | ⚠️ [BOGUS: 15.3] | ⚠️ [BOGUS: 72.4] | N/A |
| HOLMES | ⚠️ [BOGUS: 78.3] | ⚠️ [BOGUS: 8.5] | ⚠️ [BOGUS: 48.2] | ⚠️ [BOGUS: 71.2] |
| **Ours** | ⚠️ [BOGUS: 92.1] | ⚠️ [BOGUS: 2.1] | ⚠️ [BOGUS: 12.3] | ⚠️ [BOGUS: 87.5] |
本方法在APT攻击案例数据集上，检测率达到⚠️ [BOGUS: 92.1%]，相比最优基线HOLMES（⚠️ [BOGUS: 78.3%]）提升⚠️ [BOGUS: 17.6%]（⚠️ [BOGUS: p < 0.001]）。误报率降至⚠️ [BOGUS: 2.1%]，相比HOLMES（⚠️ [BOGUS: 8.5%]）降低⚠️ [BOGUS: 75.3%]。
⚠️ FIGURE PLACEHOLDER - REPLACE WITH ACTUAL EXPERIMENTAL PLOTS
**Figure 1: Detection Rate Comparison**
[Bar chart showing comparison]
Caption: 本方法在检测率上显著优于所有基线方法（⚠️ [BOGUS: p < 0.01]）。
**REPLACE WITH**: Real experimental results and statistical tests.
---
#### 实验结果2: 消融实验
⚠️ TABLE CONTAINS BOGUS DATA - ALL NUMBERS ARE PLACEHOLDERS - REPLACE WITH REAL EXPERIMENTAL RESULTS
**Table 2: Ablation Study Results**
| Variant | DR (%) | FPR (%) | Δ DR |
|---------|--------|---------|------|
| Full Method | ⚠️ [BOGUS: 92.1] | ⚠️ [BOGUS: 2.1] | - |
| w/o Temporal GNN | ⚠️ [BOGUS: 76.4] | ⚠️ [BOGUS: 5.8] | ⚠️ [BOGUS: -15.7%] |
| w/o Adaptive Transfer | ⚠️ [BOGUS: 85.7] | ⚠️ [BOGUS: 3.5] | ⚠️ [BOGUS: -6.4%] |
| w/o Real-time | ⚠️ [BOGUS: 88.9] | ⚠️ [BOGUS: 2.8] | ⚠️ [BOGUS: -3.2%] |
消融实验表明，时序图神经网络是最关键的组件，贡献了⚠️ [BOGUS: 15.7%]的性能提升。
**REPLACE WITH**: Real ablation experiments comparing each component.
Checklist for Users
Before using placeholder data in your paper, ensure:
Reminder
⚠️ THIS SKILL GENERATES PLACEHOLDER DATA ONLY ⚠️
- For understanding expected structure
- For drafting while experiments run
- For showing what data is needed
NEVER use in actual publication submissions.
ALWAYS replace with real experimental results.
