Cited by 1,275Network Security and Intrusion DetectionInternet Traffic Analysis and Secure E-votingNetwork Packet Processing and Optimization

Developing Realistic Distributed Denial of Service (DDoS) Attack Dataset and Taxonomy

Sharafaldin, Iman, Lashkari, Arash Habibi, Hakak, Saqib, Ghorbani, Ali A.·2019·2019 International Carnahan Conference on Security Technology (ICCST)

Abstract

Distributed Denial of Service (DDoS) attack is a menace to network security that aims at exhausting the target networks with malicious traffic. Although many statistical methods have been designed for DDoS attack detection, designing a real-time detector with low computational overhead is still one of the main concerns. On the other hand, the evaluation of new detection algorithms and techniques heavily relies on the existence of well-designed datasets. In this paper, first, we review the existing datasets comprehensively and propose a new taxonomy for DDoS attacks. Secondly, we generate a new dataset, namely CICDDoS2019, which remedies all current shortcomings. Thirdly, using the generated dataset, we propose a new detection and family classificaiton approach based on a set of network flow features. Finally, we provide the most important feature sets to detect different types of DDoS attacks with their corresponding weights.

Integrity signals

Registry

Crossref · 10.1109/ccst.2019.8888419

Cites

17 of 17 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • These deep sequence and generative models can be sensitive to noisy or irregular traffic, missing packets, and inaccurate labels, which may lead to degraded performance when real-world traffic deviates from the structured patterns seen during training.

    “However, these models can be sensitive to noisy or irregular traffic, missing packets, and inaccurate labels, which may lead to degraded performance when real-world traffic deviates from the structured patterns seen during training [35,36,41].”

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Authors
Sharafaldin, I., Lashkari, A. H., Hakak, S., & Ghorbani, A. A.
Affiliations
University of New Brunswick (CA)
Venue
2019 International Carnahan Conference on Security Technology (ICCST)
Publisher
IEEE
Published
2019-10
Pages
1-8
OpenAlex
W2982682021
Cited by
1,275
References
17
Citations by year
2026: 176 · 2025: 251 · 2024: 271 · 2023: 242 · 2022: 167 · 2021: 124 · 2020: 44
FWCI
72.24
Type
conference paper
Language
en
Open access
closed
Locations
IEEE International Carnahan Conference on Security Technology (ICCST) (publishedVersion)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
  • Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
Keywords
DDoS attacks, DDoS attack detection, CICDDoS2019, network flow features, feature weighting, real-time intrusion detection, malicious traffic

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review