Cited by 5,396Network Security and Intrusion DetectionArtificial Immune Systems ApplicationsAnomaly Detection Techniques and Applications

A detailed analysis of the KDD CUP 99 data set

Open access
Tavallaee, Mahbod, Bagheri, Ebrahim, Lu, Wei, Ghorbani, Ali A.·2009·2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications

Abstract

During the last decade, anomaly detection has attracted the attention of many researchers to overcome the weakness of signature-based IDSs in detecting novel attacks, and KDDCUP'99 is the mostly widely used data set for the evaluation of these systems. Having conducted a statistical analysis on this data set, we found two important issues which highly affects the performance of evaluated systems, and results in a very poor evaluation of anomaly detection approaches. To solve these issues, we have proposed a new data set, NSL-KDD, which consists of selected records of the complete KDD data set and does not suffer from any of mentioned shortcomings.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/cisda.2009.5356528

Cites

21 of 21 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • In anomaly-based intrusion detection literature, the KDD'99 dataset is the dataset of choice in most works, and some have also used the improved NSL-KDD dataset released in 2009.

    “A quick glance at Tables 22, 23, and 24 will reveal that the KDD'99 dataset is the dataset of choice in most anomaly-based intrusion detection literature, where some have also employed the improved version of the dataset, NSL-KDD [438] released in 2009.”

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 2

  1. KDD Cup 1999. Available on: http://kdd.ics.uci.edu/databases/kddcup 99/kddcup99.html, Ocotber 2007.
  2. "Nsl-kdd data set for network-based intrusion detection systems." Available on: http://nsl.cs.unb.ca/KDD/NSL-KDD.html, March 2009.

Cited by

Sorted by citations

Authors
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A.
Affiliations
University of New Brunswick (CA)
Venue
2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications
Publisher
IEEE
Published
2009-07
Pages
1-6
OpenAlex
W2099940443
Cited by
5,396
References
21
Citations by year
2026: 539 · 2025: 640 · 2024: 601 · 2023: 621 · 2022: 563 · 2021: 536 · 2020: 464 · 2019: 344 · 2018: 253 · 2017: 202 · 2016: 150 · 2015: 145 · 2014: 115 · 2013: 102 · 2012: 64
FWCI
32.57
Type
conference paper
Language
en
Locations
  • IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA) (publishedVersion)
  • NPARC (submittedVersion)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
  • Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
Keywords
KDD Cup 1999 dataset, anomaly detection, intrusion detection systems, network security, NSL-KDD dataset, novel attack detection

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review