Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization
Open accessIntegrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Many studies classify feature selection methods into three categories: filter-based techniques, wrapper techniques, and embed techniques.
“Many studies classify feature selection methods into three categories: filter-based techniques, wrapper techniques, and embed techniques”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [210]
Cites
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396 · cited 3× · see citing works
“KDD’99 (University of California, Irvine 1998-99): This dataset is an updated version of the DARPA98, by processing the tcpdump portion.”
BackgroundMethodSelf-citationTesting Intrusion detection systems
McHugh, J. (2000) · ACM Transactions on Privacy and Security · doi:10.1145/382912.382923 · Cited by 1,490 · cited 4× · see citing works
“Moreover, it lacks actual attack data records (McHugh, 2000) (Brown et al.”
BackgroundMethodInfluentialToward developing a systematic approach to generate benchmark datasets for intrusion detection
Shiravi, A., Shiravi, H., Tavallaee, M., & Ghorbani, A. A. (2012) · Computers & Security · doi:10.1016/j.cose.2011.12.012 · Cited by 1,345 · see citing works
Self-citationCharacterization of Tor Traffic using Time based Features
Lashkari, A. H., Gil, G. D., Mamun, M., & Ghorbani, A. A. (2017) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0006105602530262 · Cited by 874 · cited 3× · see citing works
“We begin to extract the 80 traffic features from the dataset using CICFlowMeter (CICFlowMeter, 2017),(Habibi Lashkari et al., 2017).”
MethodSelf-citationStatistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation
Song, J., Takakura, H., Okabe, Y., Eto, M., Inoue, D., & Nakao, K. (2011) · International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security · doi:10.1145/1978672.1978676 · Cited by 335 · cited 2× · see citing works
“The normal traffic here has been simulated repeatedly during the attacks and producing only DNS and mail traffic data, which is not reflected in real world normal network traffic, so there are no false positives, which are important for minimizing the number of alerts (Song et al., 2011) (M.”
BackgroundGeneration of a new IDS test dataset: Time to retire the KDD collection
Creech, G., & Hu, J.-K. (2013) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc.2013.6555301 · Cited by 326 · cited 1× · see citing works
“ADFA (University of New South Wales 2013): This dataset includes normal training and validating data and 10 attacks per vector (Creech and Hu, 2013).”
MethodTowards a Reliable Intrusion Detection Benchmark Dataset
Sharafaldin, I., Gharib, A., Lashkari, A. H., & Ghorbani, A. A. (2017) · Software Networking · doi:10.13052/jsn2445-9739.2017.009 · Cited by 309 · cited 9× · see citing works
“Finally, we evaluate the quality of the generated dataset by searching for common mistakes and criticisms of other synthetically created datasets, based on the 11 criteria from the last proposed dataset evaluation framework by Canadian Institute for Cybersecurity (CIC)(Sharafaldin et al., 2017).”
MethodInfluentialSelf-citationAn Evaluation Framework for Intrusion Detection Dataset
Gharib, A., Sharafaldin, I., Lashkari, A. H., et al. (2016) · International Conferences on Information Science and System · doi:10.1109/icissec.2016.7885840 · Cited by 224 · cited 6× · see citing works
“Regarding to the last dataset evaluation framework published on 2016 (Gharib et al., 2016), covering eleven criteria is necessary for each dataset.”
BackgroundMethodInfluentialSelf-citationNetwork Intrusion Detection and Prevention - Concepts and Techniques
Ghorbani, A., Lu, W., & Tavallaee, M. (2009) · Advances in Information Security · doi:10.1007/978-0-387-88771-5 · Cited by 175 · cited 1× · see citing works
“Since 1999, Scott et al. (Scott and Wilkins, 1999), Heideman and Papadopulus (Heidemann and Papdopoulos, 2009), Ghorbani et al. (Ghorbani Ali and Mahbod, 2010), Nehinbe (Nehinbe, 2011), Shiravi et al. (Ali Shiravi and Ghorbani, 2012), and Sharfaldin et al. (Gharib et al., 2016) tried to propose an…”
BackgroundSelf-citationA Labeled Data Set for Flow-Based Intrusion Detection
Sperotto, A., Sadre, R., van Vliet, F., & Pras, A. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04968-2_4 · Cited by 155 · cited 1× · see citing works
“It is labelled and is more realistic, but the lack of volume and diversity of attacks is obvious (Sperotto et al., 2009).”
BackgroundXie, M., Hu, J.-K., & Slay, J. (2014) · International Conference on Fuzzy Systems and Knowledge Discovery · doi:10.1109/fskd.2014.6980972 · Cited by 89 · cited 1× · see citing works
“In addition to the lack of attack diversity and variety of attacks, the behaviors of some attacks in this dataset are not well separated from the normal behavior (Xie and Hu, 2013) (Xie et al., 2014).”
BackgroundEvaluating host-based anomaly detection systems: A preliminary analysis of ADFA-LD
Xie, M., & Hu, J.-K. (2013) · International Congress on Image and Signal Processing · doi:10.1109/cisp.2013.6743952 · Cited by 79 · cited 2×
“In addition to the lack of attack diversity and variety of attacks, the behaviors of some attacks in this dataset are not well separated from the normal behavior (Xie and Hu, 2013) (Xie et al.”
BackgroundAnalysis of the 1999 DARPA/Lincoln Laboratory IDS evaluation data with NetADHICT
Brown, C. D., Cowperthwaite, A., Hijazi, A., & Somayaji, A. B. (2009) · IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA) · doi:10.1109/cisda.2009.5356522 · Cited by 72 · cited 1× · see citing works
“Moreover, it lacks actual attack data records (McHugh, 2000) (Brown et al., 2009).”
BackgroundChitrakar, R., & Huang, C. (2012) · International Conference on Wireless Communications, Networking and Mobile Computing · doi:10.1109/wicom.2012.6478433 · Cited by 72 · cited 1×
“…been simulated repeatedly during the attacks and producing only DNS and mail traffic data, which is not reflected in real world normal network traffic, so there are no false positives, which are important for minimizing the number of alerts (Song et al., 2011) (M. Sato, 2012) (R. Chitrakar, 2012).”
BackgroundEvaluating data mining procedures: techniques for generating artificial data sets
Scott, P., & Wilkins, E. (1999) · Information and Software Technology · doi:10.1016/s0950-5849(99)00021-x · Cited by 50 · cited 3×
“(Scott and Wilkins, 1999), Heideman and Papadopulus (Heidemann and Papdopoulos, 2009), Ghorbani et al.”
BackgroundA critical evaluation of datasets for investigating IDSs and IPSs researches
Nehinbe, J. (2011) · International Conference on Computational Intelligence and Security · doi:10.1109/cis.2011.6169141 · Cited by 45 · cited 10× · see citing works
“datasets a perfect dataset is yet to be realized (Nehinbe, 2011; Ali Shiravi and Ghorbani, 2012).”
BackgroundInfluentialForensic investigation of the OneSwarm anonymous filesharing system
Prusty, S., Levine, B. N., & Liberatore, M. (2011) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2046707.2046731 · Cited by 37 · cited 1× · see citing works
“The dataset is not useful for testing IDS and IPS techniques due to the lack of variety of traffic and attacks (Swagatika Prusty and Liberatore, 2011).”
MethodUnknown Attacks Detection Using Feature Extraction from Anomaly-Based IDS Alerts
Sato, M., Yamaki, H., & Takakura, H. (2012) · 2012 IEEE/IPSJ 12th International Symposium on Applications and the Internet · doi:10.1109/saint.2012.51 · Cited by 33
A Simple Method for Improving Intrusion Detections in Corporate Networks
Nehinbe, J. O. (2010) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-642-11530-1_13 · Cited by 26 · cited 1× · see citing works
“This dataset is used to evaluate alert correlation techniques (Nehinbe, 2010) (Group, 2000).”
MethodUses and Challenges for Network Datasets
Heidemann, J., & Papdopoulos, C. (2009) · 2009 Cybersecurity Applications & Technology Conference for Homeland Security · doi:10.1109/catch.2009.29 · Cited by 26 · cited 3×
“(Scott and Wilkins, 1999), Heideman and Papadopulus (Heidemann and Papdopoulos, 2009), Ghorbani et al.”
Background
Flagged first, then by citations
7 of the 27 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Survey of intrusion detection systems: Techniques, datasets and challenges
Khraisat, A., Gondal, I., Vamplew, P., & Kamruzzaman, J. (2019) · Cybersecurity · doi:10.1186/s42400-019-0038-7 · Cited by 2,024 · see citing works
“This dataset contains network traffic traces from Distributed Denial-of-Service (DDoS) attacks, and was collected in 2007 (Hick et al., 2007).”
Koroniotis, N., Moustafa, N., Sitnikova, E., & Turnbull, B. (2019) · Future Generation Computer Systems · doi:10.1016/j.future.2019.05.041 · Cited by 1,983 · see citing works
“Comparable to [25, 26] but more elaborate in their implementation, Sharafaldin et al. [8] crafted a testbed relying on physical machines, which were separated into two networks, the Victim-network and the Attack-network.”
BackgroundMethodInfluentialDeep Learning Approach for Intelligent Intrusion Detection System
Vinayakumar, R., Alazab, M., Soman, K. P., Poornachandran, P., Al-Nemrat, A., & Venkatraman, S. (2019) · IEEE Access · doi:10.1109/access.2019.2895334 · Cited by 2,126 · see citing works
“The details of various IDS datasets are discussed in [59] and [66].”
BackgroundAhmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. (2020) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.4150 · Cited by 1,313 · see citing works
Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study
Ferrag, M. A., Maglaras, L. A., Moschoyiannis, S., & Janicke, H. (2019) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2019.102419 · Cited by 1,298 · see citing works
“[6], which implements attacks include Brute Force SSH, DoS, Heartbleed, Web Attack, Infiltration, Botnet and DDoS, and Brute Force FTP.”
BackgroundA survey of network-based intrusion detection data sets
Ring, M., Wunderlich, S., Scheuring, D., Landes, D., & Andreas Hotho, A. (2019) · Computers & Security · doi:10.1016/j.cose.2019.06.005 · Cited by 977 · see citing works
Network Intrusion Detection for IoT Security Based on Learning Techniques
Chaabouni, N., Mosbah, M., Zemmari, A., Sauvignac, C., & Faruki, P. (2019) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2019.2896380 · Cited by 945 · see citing works
“Profile [94] approach to outline the behavior on HTTP, HTTPS, FTP, SSH and e-mail protocols.”
MethodAlsaedi, A., Moustafa, N., Tari, Z., Mahmood, A. N., & Anwar, A. (2020) · IEEE Access · doi:10.1109/access.2020.3022862 · Cited by 983 · see citing works
“Various network datasets, for example, KDDCUP99, NSL-KDD [12], UNSW-NB15 [13] and ISCX [14], were generated for evaluating IDSs; however, they do not include any specific characteristics of IoT/IIoT applications as these datasets contain neither sensors’ reading data (i.e., telemetry or measurement data) nor IoT networ…”
BackgroundMethodInfluentialAbdulrahman, S., Tout, H., Ould-Slimane, H., Mourad, A., Talhi, C., & Guizani, M. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3030072 · Cited by 796 · see citing works
Moustafa, N. (2021) · Sustainable Cities and Society · doi:10.1016/j.scs.2021.102994 · Cited by 747 · see citing works
Building an efficient intrusion detection system based on feature selection and ensemble classifier
Zhou, Y., Cheng, G., Jiang, S., & Dai, M. (2020) · Computer Networks · doi:10.1016/j.comnet.2020.107247 · Cited by 726 · see citing works
“CIC-IDS2017 dataset The CIC-IDS2017 dataset was published by Canadian Institute for Cybersecurity (CIC) in 2017, it contains benign and the most up-to-date common attacks [78].”
BackgroundMethodDeep Learning for Time Series Anomaly Detection: A Survey
Darban, Z. Z., Webb, G. I., Pan, S., Aggarwal, C. C., & Salehi, M. (2024) · ACM Computing Surveys · doi:10.1145/3691338 · Cited by 743 · see citing works
“CalIt2 [57] Real MTS 10,080 2 2 Urban events management CAP [168] [69] Real MTS 921,700,000 108 21 Medical and health CICIDS2017 [155] Real MTS 2,830,540 15 83 Server machines monitoring Credit Card fraud detection [47] Real MTS 284,807 1 31 Fraud detectcion DMDS [3] Real MTS 725,402 1 32 Industrial Control Systems En…”
Lin, X., Xiong, G., Gou, G., Li, Z., Shi, J., & Yu, J. (2022) · Proceedings of the ACM Web Conference 2022 · doi:10.1145/3485447.3512217 · Cited by 599 · see citing works
“This dataset contains two parts: (1) about 15GB traffic from the public datasets [9, 30]; (2) about 15GB traffic from our passively collected traffic under the China Science and Technology Network (CSTNET).”
MethodA Survey on Machine Learning Techniques for Cyber Security in the Last Decade
Shaukat, K., Luo, S., Varadharajan, V., Hameed, I. A., & Xu, M. (2020) · IEEE Access · doi:10.1109/access.2020.3041951 · Cited by 567 · see citing works
“The bot-IoT dataset was proposed in 2018 for IoT devices [175].”
MethodKhraisat, A., & Alazab, A. (2021) · Cybersecurity · doi:10.1186/s42400-021-00077-7 · Cited by 540 · see citing works
“According to their experimentation, the system achieved an accuracy of 99.4% for DDoS/DoS.”
InfluentialGhimire, B., & Rawat, D. B. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3150363 · Cited by 497 · see citing works
Adversarial Machine Learning for Network Intrusion Detection Systems: A Comprehensive Survey
He, K., Kim, D. S., & Asghar, M. R. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3233793 · Cited by 494 · see citing works
“Thus, NIDS evaluated with enterprise networks ( e.g., NSL-KDD [56], CIC-IDS-2017, and CSE-CIC-IDS2018 [63]) are unsuitable for IoT.”
BackgroundInfluentialCICIDS-2017 Dataset Feature Analysis With Information Gain for Anomaly Detection
Kurniabudi, K., Stiawan, D., Darmawijoyo, Idris, M. Y., Bamhdi, A. M., & Budiarto, R. (2020) · IEEE Access · doi:10.1109/access.2020.3009843 · Cited by 457 · see citing works
Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research
Zhang, Z., Hamadi, H. A., Damiani, E., Yeun, C. Y., & Taher, F. (2022) · IEEE Access · doi:10.1109/access.2022.3204051 · Cited by 450 · see citing works
Deep Learning Based Attack Detection for Cyber-Physical System Cybersecurity: A Survey
Zhang, J., Pan, L., Han, Q., Chen, C., Wen, S., & Xiang, Y. (2021) · IEEE/CAA Journal of Automatica Sinica · doi:10.1109/jas.2021.1004261 · Cited by 445 · see citing works
Booij, T. M., Chiscop, I., Meeuwissen, E., Moustafa, N., & den Hartog, F. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3085194 · Cited by 439 · see citing works
Mishra, N., & Pandya, S. (2021) · IEEE Access · doi:10.1109/access.2021.3073408 · Cited by 447 · see citing works
“CICFlowmeter [96] is a java based tool used for extracting network features from raw network captures.”
MethodInSDN: A Novel SDN Intrusion Dataset
Elsayed, M. S., Le‐Khac, N., & Jurcut, A. D. (2020) · IEEE Access · doi:10.1109/access.2020.3022633 · Cited by 427 · see citing works
MTH-IDS: A Multitiered Hybrid Intrusion Detection System for Internet of Vehicles
Yang, L., Moubayed, A., & Shami, A. A. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3084796 · Cited by 433 · see citing works
“Botnets [11] Infect multiple connected vehicles and IoV devices with Bot viruses to breach them and launch other attacks.”
BackgroundMethodResultInfluentialTowards a Standard Feature Set for Network Intrusion Detection System Datasets
Sarhan, M., Layeghy, S., & Portmann, M. (2021) · Mobile Networks and Applications · doi:10.1007/s11036-021-01843-0 · Cited by 407 · see citing works
“Four widely used NIDS datasets, referred to as UNSW-NB15 [10], BoT-IoT [7], ToN-IoT [1], and CICCSE-IDS2018 [16] have been converted into a common basic NetFlow-based feature set [15].”
MethodNetFlow Datasets for Machine Learning-Based Network Intrusion Detection Systems
Sarhan, M., Layeghy, S., Moustafa, N., & Portmann, M. (2021) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-030-72802-1_9 · Cited by 445 · see citing works
“– CSE-CIC-IDS2018- A dataset released by a collaborative project between the Communications Security Establishment (CSE) & Canadian Institute for Cybersecurity (CIC) in 2018 [14].”
MethodMachine learning methods for cyber security intrusion detection: Datasets and comparative study
Kılınçer, İ. F., Ertam, F., & Şengür, A. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.107840 · Cited by 392 · see citing works
Deep learning methods in network intrusion detection: A survey and an objective comparison
Gamage, S., & Samarabandu, J. K. (2020) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2020.102767 · Cited by 405 · see citing works
Asharf, J., Moustafa, N., Khurshid, H., Debie, E., Haider, W., & Wahab, A. (2020) · Electronics · doi:10.3390/electronics9071177 · Cited by 378 · see citing works
“This organization has three different datasets: (1) the CAIDA OC48, covering various types of data observed on an OC48 link, (2) the CAIDA DDOS, which comprises of one-hour DDoS attack traffic that happened in August 2007, and (3) the CAIDA Internet traces 2016, which is passive traffic traces from CAIDA’s Equinix-Chi…”
BackgroundMethodArtificial intelligence, cyber-threats and industry 4.0: challenges and opportunities
Bécue, A., Praça, I., & Gama, J. (2021) · Artificial Intelligence Review · doi:10.1007/s10462-020-09942-2 · Cited by 368 · see citing works
Thakkar, A., & Lohiya, R. (2020) · Archives of Computational Methods in Engineering · doi:10.1007/s11831-020-09496-0 · Cited by 390 · see citing works
“Though this dataset has been widely accepted for evaluating IDS, still its precision and absence of real-world attack scenarios were criticized in [186–188].”
MethodLucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection
Doriguzzi-Corin, R., Millar, S., Scott-Hayward, S., Martínez-del-Rincón, J., & Siracusa, D. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.2971776 · Cited by 393 · see citing works
“The CIC2017-Fri7PM trace contains a HTTP DDoS generated with LOIC, while the CSECIC2018-Wed21 trace contains a HTTP DDoS generated with HOIC.”
BackgroundMethodInfluentialDeep Learning Models for Cyber Security in IoT Networks
Roopak, M., Tian, G. Y., & Chambers, J. A. (2019) · IEEE Annual Computing and Communication Workshop and Conference (CCWC) · doi:10.1109/ccwc.2019.8666588 · Cited by 390 · see citing works
“For conducting proposed work we have used latest DDoS attack CICIDS2017 dataset[17, 18].”
MethodA Novel PCA-Firefly Based XGBoost Classification Model for Intrusion Detection in Networks Using GPU
Bhattacharya, S., Siva Rama Krishnan, S., Maddikunta, P. K. R., Kaluri, R., Singh, S., Gadekallu, T. R., Alazab, M., & Tariq, U. (2020) · Electronics · doi:10.3390/electronics9020219 · Cited by 364 · see citing works
“Moreover, there are cases of anonymous packet information, insufficient payload information, lack of features and metadata [13].”
BackgroundDeepCoin: A Novel Deep Learning and Blockchain-Based Energy Exchange Framework for Smart Grids
Ferrag, M. A., & Maglaras, L. (2020) · IEEE Transactions on Engineering Management · doi:10.1109/tem.2019.2922936 · Cited by 358 · see citing works
“The CICIDS2017 dataset is developed by Sharafaldin et al. [33] at Canadian Institute for Cybersecurity (CIC).”
MethodThakkar, A., & Lohiya, R. (2021) · Artificial Intelligence Review · doi:10.1007/s10462-021-10037-9 · Cited by 375 · see citing works
Zhang, H., Huang, L., Wu, C. Q., & Li, Z. (2020) · Computer Networks · doi:10.1016/j.comnet.2020.107315 · Cited by 346 · see citing works
Ferrag, M. A., Friha, O., Maglaras, L., Janicke, H., & Shu, L. (2021) · IEEE Access · doi:10.1109/access.2021.3118642 · Cited by 342 · see citing works
“Security researchers use cyber security datasets such as NSL-KDD [152] and CICIDS 2017-2018 [153] for the”
MethodBuilding Auto-Encoder Intrusion Detection System based on random forest feature selection
Li, X., Chen, W., Zhang, Q., & Wu, L. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101851 · Cited by 340 · see citing works
An effective intrusion detection approach using SVM with naïve Bayes feature embedding
Gu, J., & Lu, S. (2020) · Computers & Security · doi:10.1016/j.cose.2020.102158 · Cited by 347 · see citing works
Fernando, K., & Tsokos, C. P. (2021) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2020.3047335 · Cited by 316 · see citing works
“1) Dataset Description: We rely on an intrusion detection dataset (CICIDS2017) published by the Canadian Institute for Cyber-Security (CIC) at the University of New Brunswick (UNB) [54].”
MethodFeatures Dimensionality Reduction Approaches for Machine Learning Based Network Intrusion Detection
Abdulhammed, R., Musafer, H., Alessa, A., et al. (2019) · Electronics · doi:10.3390/electronics8030322 · Cited by 330 · see citing works
“[4] used a Random Forest Regressor to determine the best set of features to detect each attack family.”
BackgroundMethodInfluentialChained Anomaly Detection Models for Federated Learning: An Intrusion Detection Case Study
Preuveneers, D., Rimmer, V., Tsingenopoulos, I., Spooren, J., Joosen, W., & Ilie-Zudor, E. (2018) · Applied Sciences · doi:10.3390/app8122663 · Cited by 323 · see citing works
“More details of the dataset and the underlying principles of its collection can be found in the corresponding paper [28].”
BackgroundExplainable Artificial Intelligence in CyberSecurity: A Survey
Capuano, N., Fenza, G., Loia, V., & Stanzione, C. (2022) · IEEE Access · doi:10.1109/access.2022.3204171 · Cited by 330 · see citing works
Anomaly-Based Intrusion Detection From Network Flow Features Using Variational Autoencoder
Zavrak, S., & İskefiyeli, M. (2020) · IEEE Access · doi:10.1109/access.2020.3001350 · Cited by 322 · see citing works
“CICIDS2017 [61].”
A Scheme for Generating a Dataset for Anomalous Activity Detection in IoT Networks
Ullah, I., & Mahmoud, Q. H. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-47358-7_52 · Cited by 358 · see citing works
Kumar, P., Gupta, G. P., & Tripathi, R. (2020) · Computer Communications · doi:10.1016/j.comcom.2020.12.003 · Cited by 317 · see citing works
A holistic review of Network Anomaly Detection Systems: A comprehensive survey
Moustafa, N., Hu, J., & Slay, J. (2018) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2018.12.006 · Cited by 318 · see citing works
Benzaïd, C., & Taleb, T. (2020) · IEEE Network · doi:10.1109/mnet.001.1900252 · Cited by 315 · see citing works
“The recent intrusion detection evaluation dataset, CICIDS2017 [13]12, is used.”
MethodTalukder, M. A., Islam, M. M., Uddin, M. A., Hasan, K. F., Sharmin, S., Alyami, S. A., & Moni, M. A. (2024) · Journal Of Big Data · doi:10.1186/s40537-024-00886-w · Cited by 312 · see citing works
“The CSE-CIC-IDS2018 dataset [47], a collaborative initiative by the Communications Security Establishment (CSE) and the Canadian Institute for Cybersecurity (CIC), endeavors to meet the pressing need for comprehensive datasets suitable for rigorously testing intrusion detection systems, with a…”
BackgroundMethodDDoSNet: A Deep-Learning Model for Detecting Network Attacks
Elsayed, M. S., Le‐Khac, N., Dev, S., & Jurcut, A. D. (2020) · IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM) · doi:10.1109/wowmom49955.2020.00072 · Cited by 316 · see citing works
“The most popular public datasets, which have been used extensively for intrusion detection are KDDCUP’99 [25], NSL-KDD [26], Kyoto 2006+ [27], ISCX2012 [28], and CICIDS2017 [29].”
MethodAdversarial Machine Learning Attacks and Defense Methods in the Cyber Security Domain
Rosenberg, I., Shabtai, A., Elovici, Y., & Rokach, L. (2022) · ACM Computing Surveys · doi:10.1145/3453158 · Cited by 295 · see citing works
Increasing the Performance of Machine Learning-Based IDSs on an Imbalanced and Up-to-Date Dataset
Karataş, G., Demir, Ö., & Şahingöz, Ö. K. (2020) · IEEE Access · doi:10.1109/access.2020.2973219 · Cited by 294 · see citing works
Manimurugan, S., Almutairi, S. M., Aborokbah, M. M., Chilamkurti, N., Ganesan, S., & Patan, R. (2020) · IEEE Access · doi:10.1109/access.2020.2986013 · Cited by 298 · see citing works
“Benign: Normal traffic behaviour [12].”
MethodA Review of the Advancement in Intrusion Detection Datasets
Thakkar, A., & Lohiya, R. (2020) · Procedia Computer Science · doi:10.1016/j.procs.2020.03.330 · Cited by 293 · see citing works
A Method of Few-Shot Network Intrusion Detection Based on Meta-Learning Framework
Xu, C., Shen, J., & Du, X. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2020.2991876 · Cited by 289 · see citing works
“2) are ISCX2012 [33] and CICIDIS2017 [23].”
BackgroundMachine learning approaches to IoT security: A systematic literature review
Ahmad, R., & Alsmadi, I. M. (2021) · Internet of Things · doi:10.1016/j.iot.2021.100365 · Cited by 303 · see citing works
Multi-Stage Optimized Machine Learning Framework for Network Intrusion Detection
Injadat, M., Moubayed, A., Nassif, A. B., & Shami, A. A. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.3014929 · Cited by 294 · see citing works
“For example, the CICIDS 2017 dataset contains the following attacks: Denial-of-Service (DoS), port scanning, brute-force, web-attacks, botnets, and infiltration [12].”
BackgroundMethodResultInfluentialCyber security in smart cities: A review of deep learning-based applications and case studies
Chen, D., Wawrzyński, P., & Lv, Z. (2020) · Sustainable Cities and Society · doi:10.1016/j.scs.2020.102655 · Cited by 281 · see citing works
AI-IDS: Application of Deep Learning to Real-Time Web Intrusion Detection
Kim, A., Park, M., & Lee, D. H. (2020) · IEEE Access · doi:10.1109/access.2020.2986882 · Cited by 278 · see citing works
“3) CICIDS2017 HTTP DATASETS The CICIDS2017 datasets [34]”
BackgroundElmasry, W., Akbulut, A., & Zaim, A. H. (2019) · Computer Networks · doi:10.1016/j.comnet.2019.107042 · Cited by 278 · see citing works
A Taxonomy of Network Threats and the Effect of Current Datasets on Intrusion Detection Systems
Hindy, H., Brosset, D., Bayne, E., Seeam, A. K., Tachtatzis, C., Atkinson, R. C., & Bellekens, X. (2020) · IEEE Access · doi:10.1109/access.2020.3000179 · Cited by 283 · see citing works
Intrusion Detection of Imbalanced Network Traffic Based on Machine Learning and Deep Learning
Liu, L., Wang, P., Lin, J., & Liu, L. (2020) · IEEE Access · doi:10.1109/access.2020.3048198 · Cited by 276 · see citing works
Improving AdaBoost-based Intrusion Detection System (IDS) Performance on CIC IDS 2017 Dataset
Yulianto, A., Sukarno, P., & Suwastika, N. A. (2019) · Journal of Physics Conference Series · doi:10.1088/1742-6596/1192/1/012018 · Cited by 271 · see citing works
“It shows that although the performance of AdaBoost is superior as reported in [4], [5], and [7], the method produces inferior performance on CIC IDS 2017 Dataset.”
BackgroundMethodInfluentialA Novel Hierarchical Intrusion Detection System Based on Decision Tree and Rules-Based Models
Ahmim, A., Maglaras, L. A., Ferrag, M. A., Derdour, M., & Janicke, H. (2019) · International Conference on Distributed Computing in Smart Systems and the Internet of Things (DCOSS-IoT) · doi:10.1109/dcoss.2019.00059 · Cited by 288 · see citing works
“In our experiments, we use CICIDS 2017 [17], which”
BackgroundMethodInfluentialA survey and analysis of intrusion detection models based on CSE-CIC-IDS2018 Big Data
Leevy, J. L., & Khoshgoftaar, T. M. (2020) · Journal Of Big Data · doi:10.1186/s40537-020-00382-x · Cited by 269 · see citing works
“Datasets such as CSE-CIC-IDS2018 [5] were created to train predictive models on anomaly-based intrusion detection for network traffic.”
BackgroundMethodA Deep CNN Ensemble Framework for Efficient DDoS Attack Detection in Software Defined Networks
Haider, S., Akhunzada, A., Mustafa, İ., Patel, T. B., Fernandez, A. S., Choo, K. R., & Iqbal, J. (2020) · IEEE Access · doi:10.1109/access.2020.2976908 · Cited by 263 · see citing works
“CICIDS2017 is purely a Flow-based state-of-the-art SDN dataset (additional details about the dataset are presented in Section III-A).”
BackgroundMethodInfluentialUllah, F., Ullah, S., Srivastava, G., & Lin, J. C. (2023) · Digital Communications and Networks · doi:10.1016/j.dcan.2023.03.008 · Cited by 275 · see citing works
DCNNBiLSTM: An Efficient Hybrid Deep Learning-Based Intrusion Detection System
Hnamte, V., & Hussain, J. (2023) · Telematics and Informatics Reports · doi:10.1016/j.teler.2023.100053 · Cited by 299 · see citing works
Azam, Z., Islam, M. M., & Huda, M. N. (2023) · IEEE Access · doi:10.1109/access.2023.3296444 · Cited by 265 · see citing works
“The dataset includes normal behaviour and information on new malware attacks, including Brute Force FTP, Brute Force SSH, DoS, Heartbleed, Web Attack, Infiltration, Botnet, and DDoS [210].”
MethodRDTIDS: Rules and Decision Tree-Based Intrusion Detection System for Internet-of-Things Networks
Ferrag, M. A., Maglaras, L. A., Ahmim, A., Derdour, M., & Janicke, H. (2020) · Future Internet · doi:10.3390/fi12030044 · Cited by 251 · see citing works
“Data Set and Data Pre-Processing We use two new real traffic datasets, namely the CICIDS 2017 dataset [24] and the Bot-IoT dataset [38] for the experiments.”
MethodGAN-based imbalanced data intrusion detection system
Lee, J., & Park, K. (2019) · Personal and Ubiquitous Computing · doi:10.1007/s00779-019-01332-y · Cited by 248 · see citing works
“We used the CICIDS 2017 dataset [16] to test the method proposed in this paper.”
MethodHybrid Deep Learning for Botnet Attack Detection in the Internet-of-Things Networks
Popoola, S. I., Adebisi, B., Hammoudeh, M. A. A., Gui, G., & Gacanin, H. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3034156 · Cited by 256 · see citing works
“The application of the DEFCON-8 data set is limited because of the low number of benign traffic samples [36].”
BackgroundDing, H., Chen, L., Dong, L., Fu, Z., & Cui, X. (2022) · Future Generation Computer Systems · doi:10.1016/j.future.2022.01.026 · Cited by 240 · see citing works
Intelligent transportation system for internet of vehicles based vehicular networks for smart cities
Rani, P., & Sharma, R. (2023) · Computers and Electrical Engineering · doi:10.1016/j.compeleceng.2022.108543 · Cited by 237 · see citing works
Neupane, S., Ables, J., Anderson, W. S., Mittal, S., Rahimi, S., Banicescu, I., & Seale, M. A. (2022) · IEEE Access · doi:10.1109/access.2022.3216617 · Cited by 293 · see citing works
“They perform experiments on three different datasets: CIDDS-001, CICIDS2017, and CICDDoS19.”
BackgroundInfluentialA fast network intrusion detection system using adaptive synthetic oversampling and LightGBM
Liu, J., Gao, Y., & Hu, F. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102289 · Cited by 231 · see citing works
Intrusion Detection Using Big Data and Deep Learning Techniques
Faker, O., & Doğdu, E. (2019) · ACM Southeast Conference (ACMSE) · doi:10.1145/3299815.3314439 · Cited by 228 · see citing works
“B-Profile system [18] is used for the abstract behavior of human interactions and to generate benign natural background traffic and CICFlowMeter [24] is used to extract the features from the dataset.”
BackgroundMethodA Framework for Malicious Traffic Detection in IoT Healthcare Environment
Hussain, F., Abbas, S. G., Shah, G. A., Pires, I. M., Fayyaz, U. U., Shahzad, F., Garcia, N. M., & Zdravevski, E. (2021) · Sensors · doi:10.3390/s21093025 · Cited by 230 · see citing works
“However, this dataset does not contain real-time traffic and has some irregularities like the absence of false positives [35].”
BackgroundGraph Neural Networks for Intrusion Detection: A Survey
Bilot, T., Madhoun, N. E., Agha, K. A., & Zouaoui, A. (2023) · IEEE Access · doi:10.1109/access.2023.3275789 · Cited by 267 · see citing works
“Experiments were conducted on the 80 original features, concluding that 8 selected features are sufficient to achieve valuable results [97].”
BackgroundLouk, M. H. L., & Tama, B. A. (2022) · Expert Systems with Applications · doi:10.1016/j.eswa.2022.119030 · Cited by 223 · see citing works
Kunang, Y. N., Nurmaini, S., Stiawan, D., & Suprapto, B. Y. (2021) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2021.102804 · Cited by 236 · see citing works
FlowTransformer: A transformer framework for flow-based network intrusion detection systems
Manocchio, L. D., Layeghy, S., Lo, W. W., Kulatilleke, G. K., Sarhan, M., & Portmann, M. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.122564 · Cited by 256 · see citing works
“3) CSE-CIC-IDS2018 [30], an NIDS dataset for traditional networks including ‘seven different attack scenarios: Brute-force, Heartbleed, Botnet, DoS, DDoS, Web attacks, and infiltration of the network from inside.”
BackgroundAdversarial Machine Learning Applied to Intrusion and Malware Scenarios: A Systematic Review
Martins, N., Cruz, J. M., Cruz, T., & Abreu, P. H. (2020) · IEEE Access · doi:10.1109/access.2020.2974752 · Cited by 215 · see citing works
Evaluation of Machine Learning Algorithms for Anomaly Detection
Elmrabit, N., Zhou, F., Li, F., & Zhou, H. (2020) · International Conference on Cyber Security and Protection of Digital Services (Cyber Security) · doi:10.1109/cybersecurity49315.2020.9138871 · Cited by 223 · see citing works
“Based on their discussion and our assessment, CICIDS2017 [29] and UNSW-NB15 [30] were used to evaluate the twelve ML algorithms in our current paper.”
MethodShahraki, A., Abbasi, M., & Haugen, Ø. (2020) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2020.103770 · Cited by 217 · see citing works
A Survey of CNN-Based Network Intrusion Detection
Mohammadpour, L., Ling, T. C., Liew, C. S., & Aryanfar, A. (2022) · Applied Sciences · doi:10.3390/app12168162 · Cited by 212 · see citing works
Multi-dimensional feature fusion and stacking ensemble mechanism for network intrusion detection
Zhang, H., Li, J., Liu, X.-M., et al. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2021.03.024 · Cited by 210 · see citing works
Le, T.-T.-H., Kim, H., Kang, H., & Kim, H. (2022) · Sensors · doi:10.3390/s22031154 · Cited by 208 · see citing works
“They evaluated their proposed method using the CICIDS2017 dataset.”
BackgroundElsayed, M. S., Le‐Khac, N., Albahar, M. A., & Jurcut, A. D. (2021) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2021.103160 · Cited by 209 · see citing works
A New Ensemble-Based Intrusion Detection System for Internet of Things
Abbas, A., Khan, M. A., Latif, S., Ajaz, M., Shah, A. A., & Ahmad, J. E. (2021) · Arabian Journal for Science and Engineering · doi:10.1007/s13369-021-06086-5 · Cited by 221 · see citing works
“The dataset used in this study has been created by The Canadian Institute for Cybersecurity (CIC) in 2017 [53].”
MethodIoT Intrusion Detection System Using Deep Learning and Enhanced Transient Search Optimization
Fatani, A., Elaziz, M. A., Dahou, A., Al‐qaness, M. A. A., & Lu, S. (2021) · IEEE Access · doi:10.1109/access.2021.3109081 · Cited by 205 · see citing works
“From these results it can be seen that the values of FPR for the TSODE are better than other algorithms in the binary and multi-class classification cases among all the tested four datasets (i.e., KDDCup-99, NSL-KDD, BoT-IOT, and CICIDS-2017).”
MethodInfluentialNetwork Intrusion Detection: Based on Deep Hierarchical Network and Original Flow Data
Zhang, Y., Chen, X., Jin, L., Wang, X., & Guo, D. (2019) · IEEE Access · doi:10.1109/access.2019.2905041 · Cited by 206 · see citing works
“From the experimental results on the CICIDS2017 dataset in TABLE 3, we can find that the deep hierarchical network model proposed by us has better performance than the traditional machine learning algorithm model by Sharafaldin et al. [33].”
MethodKareem, S. S., Mostafa, R. R., Hashim, F. A., & El-Bakry, H. M. (2022) · Sensors · doi:10.3390/s22041396 · Cited by 201 · see citing works
“This dataset has 2,830,743 records on 8 files, with each record including 78 distinct features with their label [69].”
BackgroundBukhari, S. M. S., Zafar, M. H., Houran, M. A., Moosavi, S. K. R., Mansoor, M., Muaaz, M., & Sanfilippo, F. (2024) · Ad Hoc Networks · doi:10.1016/j.adhoc.2024.103407 · Cited by 209 · see citing works
Feature extraction for machine learning-based intrusion detection in IoT networks
Sarhan, M., Layeghy, S., Moustafa, N., Gallagher, M. R., & Portmann, M. (2022) · Digital Communications and Networks · doi:10.1016/j.dcan.2022.08.012 · Cited by 227 · see citing works
“• CSE-CIC-IDS2018 : A dataset released by a collaborative project between the Communications Security Establishment (CSE) and Canadian Institute for Cybersecurity (CIC) in 2018 [29].”
BackgroundPinto, A., Herrera, L.-C., Donoso, Y., & Gutiérrez, J. (2023) · Sensors · doi:10.3390/s23052415 · Cited by 212 · see citing works
“[80] CICDS 2017 Generative models Quadratic discriminant analysis 0.”
InfluentialZhang, C., Costa‐Pérez, X., & Patras, P. (2022) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2021.3137084 · Cited by 198 · see citing works
Ali, S., Li, Q., & Yousafzai, A. (2023) · Ad Hoc Networks · doi:10.1016/j.adhoc.2023.103320 · Cited by 216 · see citing works
A Hybrid Intrusion Detection System Based on Scalable K-Means+ Random Forest and Deep Learning
Liu, C., Gu, Z., & Wang, J. (2021) · IEEE Access · doi:10.1109/access.2021.3082147 · Cited by 194 · see citing works
“The CIC-IDS2017 dataset was generated in 2017 [26] In this example, the categorical feature service is converted to numerical values in the range of [1,70] with a step size of 1.”
Method
- Authors
- Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A.
- Affiliations
- University of New Brunswick (CA)
- University of New Brunswick (UNB), Canada
- Venue
- Proceedings of the 4th International Conference on Information Systems Security and Privacy
- Published
- 2018
- Pages
- 108-116
- OpenAlex
- W2789828921
- Cited by
- 5,318
- References
- 27
- Citations by year
- 2026: 1170 · 2025: 1032 · 2024: 803 · 2023: 704 · 2022: 558 · 2021: 518 · 2020: 332 · 2019: 165 · 2018: 35 · 2015: 1
- FWCI
- 215.46
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- cc-by-nc-nd
- Locations
- International Conference on Information Systems Security and Privacy (ICISSP) (publishedVersion, cc-by-nc-nd)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- intrusion detection, intrusion detection datasets, network traffic characterization, network security, dataset construction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
