The DOI matches its Crossref record; 17 of the 17 references it cites were found in a registry or an index.
Developing Realistic Distributed Denial of Service (DDoS) Attack Dataset and Taxonomy
Abstract
Distributed Denial of Service (DDoS) attack is a menace to network security that aims at exhausting the target networks with malicious traffic. Although many statistical methods have been designed for DDoS attack detection, designing a real-time detector with low computational overhead is still one of the main concerns. On the other hand, the evaluation of new detection algorithms and techniques heavily relies on the existence of well-designed datasets. In this paper, first, we review the existing datasets comprehensively and propose a new taxonomy for DDoS attacks. Secondly, we generate a new dataset, namely CICDDoS2019, which remedies all current shortcomings. Thirdly, using the generated dataset, we propose a new detection and family classificaiton approach based on a set of network flow features. Finally, we provide the most important feature sets to detect different types of DDoS attacks with their corresponding weights.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“However, these models can be sensitive to noisy or irregular traffic, missing packets, and inaccurate labels, which may lead to degraded performance when real-world traffic deviates from the structured patterns seen during training [35,36,41].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [41]
Citations
Cites
Breiman, L. (2001) · Machine Learning · doi:10.1023/a:1010933404324 · Cited by 133,538
Scikit-learn: Machine Learning in Python
Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., Blondel, M., Müller, A., Nothman, J., Louppe, G., et al. (2012) · arXiv · doi:10.48550/arxiv.1201.0490 · Cited by 71,016
Quinlan, J. R. (1986) · Machine Learning · doi:10.1007/bf00116251 · Cited by 21,439
A taxonomy of DDoS attack and DDoS defense mechanisms
Mirković, J., & Reiher, P. L. (2004) · ACM SIGCOMM Computer Communication Review · doi:10.1145/997150.997156 · Cited by 2,028
Toward developing a systematic approach to generate benchmark datasets for intrusion detection
Shiravi, A., Shiravi, H., Tavallaee, M., & Ghorbani, A. A. (2012) · Computers & Security · doi:10.1016/j.cose.2011.12.012 · Cited by 1,345
Self-citationCharacterization of Tor Traffic using Time based Features
Lashkari, A. H., Gil, G. D., Mamun, M., & Ghorbani, A. A. (2017) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0006105602530262 · Cited by 926
Self-citationTowards a Reliable Intrusion Detection Benchmark Dataset
Sharafaldin, I., Gharib, A., Lashkari, A. H., & Ghorbani, A. A. (2017) · Software Networking · doi:10.13052/jsn2445-9739.2017.009 · Cited by 309
Self-citationDiscriminating DDoS Attacks from Flash Crowds Using Flow Correlation Coefficient
Yu, S., Zhou, W., Jia, W., Guo, S., Xiang, Y., & Tang, F. (2011) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2011.262 · Cited by 222
A covariance analysis model for DDoS attack detection
Jin, S., & Yeung, D. S. (2004) · International Conference on Communications · doi:10.1109/icc.2004.1312847 · Cited by 142
A survey and taxonomy of DoS attacks in cloud computing
Masdari, M., & Jalali, M. (2016) · Security and Communication Networks · doi:10.1002/sec.1539 · Cited by 132
Application layer HTTP-GET flood DDoS attacks: Research landscape and challenges
Singh, K., Singh, P., & Kumar, K. (2016) · Computers & Security · doi:10.1016/j.cose.2016.10.005 · Cited by 108
DoS and DDoS Attacks: Defense, Detection and Traceback Mechanisms - A Survey
Prasad, K. M., Reddy, D. A. R. M., & Rao, K. V. (2014) · Global Journal of Computer Science and Technology · Cited by 73
Analysis of the 1999 DARPA/Lincoln Laboratory IDS evaluation data with NetADHICT
Brown, C. D., Cowperthwaite, A., Hijazi, A., & Somayaji, A. B. (2009) · IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA) · doi:10.1109/cisda.2009.5356522 · Cited by 72
Detection of DDoS attacks using Enhanced Support Vector Machines with real time generated dataset
Subbulakshmi, T., Balakrishnan, K., Shalinie, S. M., Anandkumar, D. K. M., Ganapathi‐Subramanian, V., & Kannathal, K. (2011) · International Conference on Advanced Computing · doi:10.1109/icoac.2011.6165212 · Cited by 45
A comprehensive taxonomy of DDOS attacks and defense mechanism applying in a smart classification
Asosheh, A., & Ramezani, N. (2008) · Cited by 44
DDoS attacks, new DDoS taxonomy and mitigation solutions — A survey
Bhardwaj, A., Subrahmanyam, G. V. B., Avasthi, V., Hanumat Sastry, G., & Goundar, S. (2016) · International Conference on Signal Processing, Communication, Power and Embedded System (SCOPES) · doi:10.1109/scopes.2016.7955549 · Cited by 33
An Approach of DDOS Attack Detection Using Classifiers
Singh, K. J., & De, T. (2015) · Springer eBooks · doi:10.1007/978-81-322-2550-8_41 · Cited by 23
Flagged first, then by citations
Research works printed but not linked: 5
- 1987, Request for comments: 1001 (rfc1001), Protocol Standard for a NetBIOS Service on a TCP/UDP Transport Concepts and Methods
- 2016, Request for comments: 7766 (rfc7766), DNS Transport over TCP - Implementation Requirements
- 2017, CICFlowMeter
- 0, The CAIDA UCSD ”DDoS Attack 2007” Dataset
- 0, DARPA 2000 Intrustion Detection Scenario Specific Data Sets
Cited by
Sorted by citations
Moustafa, N. (2021) · Sustainable Cities and Society · doi:10.1016/j.scs.2021.102994 · Cited by 747
Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research
Zhang, Z., Hamadi, H. A., Damiani, E., Yeun, C. Y., & Taher, F. (2022) · IEEE Access · doi:10.1109/access.2022.3204051 · Cited by 450
InSDN: A Novel SDN Intrusion Dataset
Elsayed, M. S., Le‐Khac, N., & Jurcut, A. D. (2020) · IEEE Access · doi:10.1109/access.2020.3022633 · Cited by 427
Mishra, N., & Pandya, S. (2021) · IEEE Access · doi:10.1109/access.2021.3073408 · Cited by 447
A systematic literature review of methods and datasets for anomaly-based network intrusion detection
Yang, Z., Liu, X., Li, T., Wu, D., Wang, J., Zhao, Y., & Han, H. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102675 · Cited by 410
Metadata
- Authors
- Sharafaldin, I., Lashkari, A. H., Hakak, S., & Ghorbani, A. A.
- Affiliations
- University of New Brunswick (CA)
- Venue
- 2019 International Carnahan Conference on Security Technology (ICCST)
- Publisher
- IEEE
- Published
- 2019-10
- Pages
- 1-8
- OpenAlex
- W2982682021
- Cited by
- 1,275
- References
- 17
- Citations by year
- 2026: 176 · 2025: 251 · 2024: 271 · 2023: 242 · 2022: 167 · 2021: 124 · 2020: 44
- FWCI
- 72.24
- Type
- conference paper
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE International Carnahan Conference on Security Technology (ICCST) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Keywords
- DDoS attacks, DDoS attack detection, CICDDoS2019, network flow features, feature weighting, real-time intrusion detection, malicious traffic
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
