The DOI matches its Crossref record; 20 of the 27 references it cites were found in a registry or an index.
Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization
Open accessOverview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Many studies classify feature selection methods into three categories: filter-based techniques, wrapper techniques, and embed techniques”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [210]
Citations
Cites
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396 · cited 3×
“KDD’99 (University of California, Irvine 1998-99): This dataset is an updated version of the DARPA98, by processing the tcpdump portion.”
BackgroundMethodSelf-citationTesting Intrusion detection systems
McHugh, J. (2000) · ACM Transactions on Privacy and Security · doi:10.1145/382912.382923 · Cited by 1,490 · cited 4×
“Moreover, it lacks actual attack data records (McHugh, 2000) (Brown et al.”
BackgroundMethodInfluentialToward developing a systematic approach to generate benchmark datasets for intrusion detection
Shiravi, A., Shiravi, H., Tavallaee, M., & Ghorbani, A. A. (2012) · Computers & Security · doi:10.1016/j.cose.2011.12.012 · Cited by 1,345
Self-citationCharacterization of Tor Traffic using Time based Features
Lashkari, A. H., Gil, G. D., Mamun, M., & Ghorbani, A. A. (2017) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0006105602530262 · Cited by 926 · cited 3×
“We begin to extract the 80 traffic features from the dataset using CICFlowMeter (CICFlowMeter, 2017),(Habibi Lashkari et al., 2017).”
MethodSelf-citationStatistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation
Song, J., Takakura, H., Okabe, Y., Eto, M., Inoue, D., & Nakao, K. (2011) · International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security · doi:10.1145/1978672.1978676 · Cited by 335 · cited 2×
“The normal traffic here has been simulated repeatedly during the attacks and producing only DNS and mail traffic data, which is not reflected in real world normal network traffic, so there are no false positives, which are important for minimizing the number of alerts (Song et al., 2011) (M.”
BackgroundGeneration of a new IDS test dataset: Time to retire the KDD collection
Creech, G., & Hu, J.-K. (2013) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc.2013.6555301 · Cited by 326 · cited 1×
“ADFA (University of New South Wales 2013): This dataset includes normal training and validating data and 10 attacks per vector (Creech and Hu, 2013).”
MethodTowards a Reliable Intrusion Detection Benchmark Dataset
Sharafaldin, I., Gharib, A., Lashkari, A. H., & Ghorbani, A. A. (2017) · Software Networking · doi:10.13052/jsn2445-9739.2017.009 · Cited by 309 · cited 9×
“Finally, we evaluate the quality of the generated dataset by searching for common mistakes and criticisms of other synthetically created datasets, based on the 11 criteria from the last proposed dataset evaluation framework by Canadian Institute for Cybersecurity (CIC)(Sharafaldin et al., 2017).”
MethodInfluentialSelf-citationAn Evaluation Framework for Intrusion Detection Dataset
Gharib, A., Sharafaldin, I., Lashkari, A. H., et al. (2016) · International Conferences on Information Science and System · doi:10.1109/icissec.2016.7885840 · Cited by 224 · cited 6×
“Regarding to the last dataset evaluation framework published on 2016 (Gharib et al., 2016), covering eleven criteria is necessary for each dataset.”
BackgroundMethodInfluentialSelf-citationNetwork Intrusion Detection and Prevention - Concepts and Techniques
Ghorbani, A., Lu, W., & Tavallaee, M. (2009) · Advances in Information Security · doi:10.1007/978-0-387-88771-5 · Cited by 175 · cited 1×
“Since 1999, Scott et al. (Scott and Wilkins, 1999), Heideman and Papadopulus (Heidemann and Papdopoulos, 2009), Ghorbani et al. (Ghorbani Ali and Mahbod, 2010), Nehinbe (Nehinbe, 2011), Shiravi et al. (Ali Shiravi and Ghorbani, 2012), and Sharfaldin et al. (Gharib et al., 2016) tried to propose an…”
BackgroundSelf-citationA Labeled Data Set for Flow-Based Intrusion Detection
Sperotto, A., Sadre, R., van Vliet, F., & Pras, A. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04968-2_4 · Cited by 155 · cited 1×
“It is labelled and is more realistic, but the lack of volume and diversity of attacks is obvious (Sperotto et al., 2009).”
Background
Cited by
Sorted by citations
Survey of intrusion detection systems: Techniques, datasets and challenges
Khraisat, A., Gondal, I., Vamplew, P., & Kamruzzaman, J. (2019) · Cybersecurity · doi:10.1186/s42400-019-0038-7 · Cited by 2,024
“This dataset contains network traffic traces from Distributed Denial-of-Service (DDoS) attacks, and was collected in 2007 (Hick et al., 2007).”
Koroniotis, N., Moustafa, N., Sitnikova, E., & Turnbull, B. (2019) · Future Generation Computer Systems · doi:10.1016/j.future.2019.05.041 · Cited by 1,983
“Comparable to [25, 26] but more elaborate in their implementation, Sharafaldin et al. [8] crafted a testbed relying on physical machines, which were separated into two networks, the Victim-network and the Attack-network.”
BackgroundMethodInfluentialDeep Learning Approach for Intelligent Intrusion Detection System
Vinayakumar, R., Alazab, M., Soman, K. P., Poornachandran, P., Al-Nemrat, A., & Venkatraman, S. (2019) · IEEE Access · doi:10.1109/access.2019.2895334 · Cited by 2,228
“The details of various IDS datasets are discussed in [59] and [66].”
BackgroundAhmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. (2020) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.4150 · Cited by 1,514
Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study
Ferrag, M. A., Maglaras, L. A., Moschoyiannis, S., & Janicke, H. (2019) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2019.102419 · Cited by 1,386
“[6], which implements attacks include Brute Force SSH, DoS, Heartbleed, Web Attack, Infiltration, Botnet and DDoS, and Brute Force FTP.”
BackgroundA survey of network-based intrusion detection data sets
Ring, M., Wunderlich, S., Scheuring, D., Landes, D., & Andreas Hotho, A. (2019) · Computers & Security · doi:10.1016/j.cose.2019.06.005 · Cited by 977
Network Intrusion Detection for IoT Security Based on Learning Techniques
Chaabouni, N., Mosbah, M., Zemmari, A., Sauvignac, C., & Faruki, P. (2019) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2019.2896380 · Cited by 1,000
“Profile [94] approach to outline the behavior on HTTP, HTTPS, FTP, SSH and e-mail protocols.”
MethodAlsaedi, A., Moustafa, N., Tari, Z., Mahmood, A. N., & Anwar, A. (2020) · IEEE Access · doi:10.1109/access.2020.3022862 · Cited by 1,051
“Various network datasets, for example, KDDCUP99, NSL-KDD [12], UNSW-NB15 [13] and ISCX [14], were generated for evaluating IDSs; however, they do not include any specific characteristics of IoT/IIoT applications as these datasets contain neither sensors’ reading data (i.e., telemetry or measurement data) nor IoT networ…”
BackgroundMethodInfluentialAbdulrahman, S., Tout, H., Ould-Slimane, H., Mourad, A., Talhi, C., & Guizani, M. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3030072 · Cited by 796
Moustafa, N. (2021) · Sustainable Cities and Society · doi:10.1016/j.scs.2021.102994 · Cited by 747
Building an efficient intrusion detection system based on feature selection and ensemble classifier
Zhou, Y., Cheng, G., Jiang, S., & Dai, M. (2020) · Computer Networks · doi:10.1016/j.comnet.2020.107247 · Cited by 745
“CIC-IDS2017 dataset The CIC-IDS2017 dataset was published by Canadian Institute for Cybersecurity (CIC) in 2017, it contains benign and the most up-to-date common attacks [78].”
BackgroundMethodDeep Learning for Time Series Anomaly Detection: A Survey
Darban, Z. Z., Webb, G. I., Pan, S., Aggarwal, C. C., & Salehi, M. (2024) · ACM Computing Surveys · doi:10.1145/3691338 · Cited by 853
“CalIt2 [57] Real MTS 10,080 2 2 Urban events management CAP [168] [69] Real MTS 921,700,000 108 21 Medical and health CICIDS2017 [155] Real MTS 2,830,540 15 83 Server machines monitoring Credit Card fraud detection [47] Real MTS 284,807 1 31 Fraud detectcion DMDS [3] Real MTS 725,402 1 32 Industrial Control Systems En…”
Lin, X., Xiong, G., Gou, G., Li, Z., Shi, J., & Yu, J. (2022) · Proceedings of the ACM Web Conference 2022 · doi:10.1145/3485447.3512217 · Cited by 599
“This dataset contains two parts: (1) about 15GB traffic from the public datasets [9, 30]; (2) about 15GB traffic from our passively collected traffic under the China Science and Technology Network (CSTNET).”
MethodA Survey on Machine Learning Techniques for Cyber Security in the Last Decade
Shaukat, K., Luo, S., Varadharajan, V., Hameed, I. A., & Xu, M. (2020) · IEEE Access · doi:10.1109/access.2020.3041951 · Cited by 607
“The bot-IoT dataset was proposed in 2018 for IoT devices [175].”
MethodKhraisat, A., & Alazab, A. (2021) · Cybersecurity · doi:10.1186/s42400-021-00077-7 · Cited by 578
“According to their experimentation, the system achieved an accuracy of 99.4% for DDoS/DoS.”
InfluentialGhimire, B., & Rawat, D. B. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3150363 · Cited by 520
Adversarial Machine Learning for Network Intrusion Detection Systems: A Comprehensive Survey
He, K., Kim, D. S., & Asghar, M. R. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3233793 · Cited by 518
“Thus, NIDS evaluated with enterprise networks ( e.g., NSL-KDD [56], CIC-IDS-2017, and CSE-CIC-IDS2018 [63]) are unsuitable for IoT.”
BackgroundInfluentialCICIDS-2017 Dataset Feature Analysis With Information Gain for Anomaly Detection
Kurniabudi, K., Stiawan, D., Darmawijoyo, Idris, M. Y., Bamhdi, A. M., & Budiarto, R. (2020) · IEEE Access · doi:10.1109/access.2020.3009843 · Cited by 457
Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research
Zhang, Z., Hamadi, H. A., Damiani, E., Yeun, C. Y., & Taher, F. (2022) · IEEE Access · doi:10.1109/access.2022.3204051 · Cited by 450
Deep Learning Based Attack Detection for Cyber-Physical System Cybersecurity: A Survey
Zhang, J., Pan, L., Han, Q., Chen, C., Wen, S., & Xiang, Y. (2021) · IEEE/CAA Journal of Automatica Sinica · doi:10.1109/jas.2021.1004261 · Cited by 450
Booij, T. M., Chiscop, I., Meeuwissen, E., Moustafa, N., & den Hartog, F. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3085194 · Cited by 439
Mishra, N., & Pandya, S. (2021) · IEEE Access · doi:10.1109/access.2021.3073408 · Cited by 447
“CICFlowmeter [96] is a java based tool used for extracting network features from raw network captures.”
MethodInSDN: A Novel SDN Intrusion Dataset
Elsayed, M. S., Le‐Khac, N., & Jurcut, A. D. (2020) · IEEE Access · doi:10.1109/access.2020.3022633 · Cited by 468
MTH-IDS: A Multitiered Hybrid Intrusion Detection System for Internet of Vehicles
Yang, L., Moubayed, A., & Shami, A. A. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3084796 · Cited by 454
“Botnets [11] Infect multiple connected vehicles and IoV devices with Bot viruses to breach them and launch other attacks.”
BackgroundMethodResultInfluentialTowards a Standard Feature Set for Network Intrusion Detection System Datasets
Sarhan, M., Layeghy, S., & Portmann, M. (2021) · Mobile Networks and Applications · doi:10.1007/s11036-021-01843-0 · Cited by 407
“Four widely used NIDS datasets, referred to as UNSW-NB15 [10], BoT-IoT [7], ToN-IoT [1], and CICCSE-IDS2018 [16] have been converted into a common basic NetFlow-based feature set [15].”
MethodNetFlow Datasets for Machine Learning-Based Network Intrusion Detection Systems
Sarhan, M., Layeghy, S., Moustafa, N., & Portmann, M. (2021) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-030-72802-1_9 · Cited by 445
“– CSE-CIC-IDS2018- A dataset released by a collaborative project between the Communications Security Establishment (CSE) & Canadian Institute for Cybersecurity (CIC) in 2018 [14].”
MethodMachine learning methods for cyber security intrusion detection: Datasets and comparative study
Kılınçer, İ. F., Ertam, F., & Şengür, A. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.107840 · Cited by 392
Deep learning methods in network intrusion detection: A survey and an objective comparison
Gamage, S., & Samarabandu, J. K. (2020) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2020.102767 · Cited by 422
Asharf, J., Moustafa, N., Khurshid, H., Debie, E., Haider, W., & Wahab, A. (2020) · Electronics · doi:10.3390/electronics9071177 · Cited by 378
“This organization has three different datasets: (1) the CAIDA OC48, covering various types of data observed on an OC48 link, (2) the CAIDA DDOS, which comprises of one-hour DDoS attack traffic that happened in August 2007, and (3) the CAIDA Internet traces 2016, which is passive traffic traces from CAIDA’s Equinix-Chi…”
BackgroundMethodArtificial intelligence, cyber-threats and industry 4.0: challenges and opportunities
Bécue, A., Praça, I., & Gama, J. (2021) · Artificial Intelligence Review · doi:10.1007/s10462-020-09942-2 · Cited by 368
Thakkar, A., & Lohiya, R. (2020) · Archives of Computational Methods in Engineering · doi:10.1007/s11831-020-09496-0 · Cited by 412
“Though this dataset has been widely accepted for evaluating IDS, still its precision and absence of real-world attack scenarios were criticized in [186–188].”
MethodLucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection
Doriguzzi-Corin, R., Millar, S., Scott-Hayward, S., Martínez-del-Rincón, J., & Siracusa, D. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.2971776 · Cited by 393
“The CIC2017-Fri7PM trace contains a HTTP DDoS generated with LOIC, while the CSECIC2018-Wed21 trace contains a HTTP DDoS generated with HOIC.”
BackgroundMethodInfluentialDeep Learning Models for Cyber Security in IoT Networks
Roopak, M., Tian, G. Y., & Chambers, J. A. (2019) · IEEE Annual Computing and Communication Workshop and Conference (CCWC) · doi:10.1109/ccwc.2019.8666588 · Cited by 390
“For conducting proposed work we have used latest DDoS attack CICIDS2017 dataset[17, 18].”
MethodA Novel PCA-Firefly Based XGBoost Classification Model for Intrusion Detection in Networks Using GPU
Bhattacharya, S., Siva Rama Krishnan, S., Maddikunta, P. K. R., Kaluri, R., Singh, S., Gadekallu, T. R., Alazab, M., & Tariq, U. (2020) · Electronics · doi:10.3390/electronics9020219 · Cited by 364
“Moreover, there are cases of anonymous packet information, insufficient payload information, lack of features and metadata [13].”
BackgroundDeepCoin: A Novel Deep Learning and Blockchain-Based Energy Exchange Framework for Smart Grids
Ferrag, M. A., & Maglaras, L. (2020) · IEEE Transactions on Engineering Management · doi:10.1109/tem.2019.2922936 · Cited by 358
“The CICIDS2017 dataset is developed by Sharafaldin et al. [33] at Canadian Institute for Cybersecurity (CIC).”
MethodThakkar, A., & Lohiya, R. (2021) · Artificial Intelligence Review · doi:10.1007/s10462-021-10037-9 · Cited by 394
Zhang, H., Huang, L., Wu, C. Q., & Li, Z. (2020) · Computer Networks · doi:10.1016/j.comnet.2020.107315 · Cited by 362
Ferrag, M. A., Friha, O., Maglaras, L., Janicke, H., & Shu, L. (2021) · IEEE Access · doi:10.1109/access.2021.3118642 · Cited by 342
“Security researchers use cyber security datasets such as NSL-KDD [152] and CICIDS 2017-2018 [153] for the”
MethodBuilding Auto-Encoder Intrusion Detection System based on random forest feature selection
Li, X., Chen, W., Zhang, Q., & Wu, L. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101851 · Cited by 340
An effective intrusion detection approach using SVM with naïve Bayes feature embedding
Gu, J., & Lu, S. (2020) · Computers & Security · doi:10.1016/j.cose.2020.102158 · Cited by 360
Fernando, K. R. M., & Tsokos, C. P. (2021) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2020.3047335 · Cited by 372
“1) Dataset Description: We rely on an intrusion detection dataset (CICIDS2017) published by the Canadian Institute for Cyber-Security (CIC) at the University of New Brunswick (UNB) [54].”
MethodFeatures Dimensionality Reduction Approaches for Machine Learning Based Network Intrusion Detection
Abdulhammed, R., Musafer, H., Alessa, A., et al. (2019) · Electronics · doi:10.3390/electronics8030322 · Cited by 330
“[4] used a Random Forest Regressor to determine the best set of features to detect each attack family.”
BackgroundMethodInfluentialExplainable Artificial Intelligence in CyberSecurity: A Survey
Capuano, N., Fenza, G., Loia, V., & Stanzione, C. (2022) · IEEE Access · doi:10.1109/access.2022.3204171 · Cited by 330
Chained Anomaly Detection Models for Federated Learning: An Intrusion Detection Case Study
Preuveneers, D., Rimmer, V., Tsingenopoulos, I., Spooren, J., Joosen, W., & Ilie-Zudor, E. (2018) · Applied Sciences · doi:10.3390/app8122663 · Cited by 323
“More details of the dataset and the underlying principles of its collection can be found in the corresponding paper [28].”
BackgroundAnomaly-Based Intrusion Detection From Network Flow Features Using Variational Autoencoder
Zavrak, S., & İskefiyeli, M. (2020) · IEEE Access · doi:10.1109/access.2020.3001350 · Cited by 341
“CICIDS2017 [61].”
A Scheme for Generating a Dataset for Anomalous Activity Detection in IoT Networks
Ullah, I., & Mahmoud, Q. H. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-47358-7_52 · Cited by 358
Kumar, P., Gupta, G. P., & Tripathi, R. (2020) · Computer Communications · doi:10.1016/j.comcom.2020.12.003 · Cited by 317
A holistic review of Network Anomaly Detection Systems: A comprehensive survey
Moustafa, N., Hu, J., & Slay, J. (2018) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2018.12.006 · Cited by 318
Benzaïd, C., & Taleb, T. (2020) · IEEE Network · doi:10.1109/mnet.001.1900252 · Cited by 315
“The recent intrusion detection evaluation dataset, CICIDS2017 [13]12, is used.”
MethodTalukder, M. A., Islam, M. M., Uddin, M. A., Hasan, K. F., Sharmin, S., Alyami, S. A., & Moni, M. A. (2024) · Journal Of Big Data · doi:10.1186/s40537-024-00886-w · Cited by 405
“The CSE-CIC-IDS2018 dataset [47], a collaborative initiative by the Communications Security Establishment (CSE) and the Canadian Institute for Cybersecurity (CIC), endeavors to meet the pressing need for comprehensive datasets suitable for rigorously testing intrusion detection systems, with a…”
BackgroundMethodDDoSNet: A Deep-Learning Model for Detecting Network Attacks
Elsayed, M. S., Le‐Khac, N., Dev, S., & Jurcut, A. D. (2020) · IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM) · doi:10.1109/wowmom49955.2020.00072 · Cited by 316
“The most popular public datasets, which have been used extensively for intrusion detection are KDDCUP’99 [25], NSL-KDD [26], Kyoto 2006+ [27], ISCX2012 [28], and CICIDS2017 [29].”
MethodAdversarial Machine Learning Attacks and Defense Methods in the Cyber Security Domain
Rosenberg, I., Shabtai, A., Elovici, Y., & Rokach, L. (2022) · ACM Computing Surveys · doi:10.1145/3453158 · Cited by 295
Increasing the Performance of Machine Learning-Based IDSs on an Imbalanced and Up-to-Date Dataset
Karataş, G., Demir, Ö., & Şahingöz, Ö. K. (2020) · IEEE Access · doi:10.1109/access.2020.2973219 · Cited by 294
Manimurugan, S., Almutairi, S. M., Aborokbah, M. M., Chilamkurti, N., Ganesan, S., & Patan, R. (2020) · IEEE Access · doi:10.1109/access.2020.2986013 · Cited by 298
“Benign: Normal traffic behaviour [12].”
MethodA Review of the Advancement in Intrusion Detection Datasets
Thakkar, A., & Lohiya, R. (2020) · Procedia Computer Science · doi:10.1016/j.procs.2020.03.330 · Cited by 293
A Method of Few-Shot Network Intrusion Detection Based on Meta-Learning Framework
Xu, C., Shen, J., & Du, X. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2020.2991876 · Cited by 289
“2) are ISCX2012 [33] and CICIDIS2017 [23].”
BackgroundMachine learning approaches to IoT security: A systematic literature review
Ahmad, R., & Alsmadi, I. M. (2021) · Internet of Things · doi:10.1016/j.iot.2021.100365 · Cited by 317
Multi-Stage Optimized Machine Learning Framework for Network Intrusion Detection
Injadat, M., Moubayed, A., Nassif, A. B., & Shami, A. A. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.3014929 · Cited by 305
“For example, the CICIDS 2017 dataset contains the following attacks: Denial-of-Service (DoS), port scanning, brute-force, web-attacks, botnets, and infiltration [12].”
BackgroundMethodResultInfluentialCyber security in smart cities: A review of deep learning-based applications and case studies
Chen, D., Wawrzyński, P., & Lv, Z. (2020) · Sustainable Cities and Society · doi:10.1016/j.scs.2020.102655 · Cited by 296
AI-IDS: Application of Deep Learning to Real-Time Web Intrusion Detection
Kim, A., Park, M., & Lee, D. H. (2020) · IEEE Access · doi:10.1109/access.2020.2986882 · Cited by 278
“3) CICIDS2017 HTTP DATASETS The CICIDS2017 datasets [34]”
BackgroundElmasry, W., Akbulut, A., & Zaim, A. H. (2019) · Computer Networks · doi:10.1016/j.comnet.2019.107042 · Cited by 285
A Taxonomy of Network Threats and the Effect of Current Datasets on Intrusion Detection Systems
Hindy, H., Brosset, D., Bayne, E., Seeam, A. K., Tachtatzis, C., Atkinson, R. C., & Bellekens, X. (2020) · IEEE Access · doi:10.1109/access.2020.3000179 · Cited by 283
Intrusion Detection of Imbalanced Network Traffic Based on Machine Learning and Deep Learning
Liu, L., Wang, P., Lin, J., & Liu, L. (2020) · IEEE Access · doi:10.1109/access.2020.3048198 · Cited by 313
Improving AdaBoost-based Intrusion Detection System (IDS) Performance on CIC IDS 2017 Dataset
Yulianto, A., Sukarno, P., & Suwastika, N. A. (2019) · Journal of Physics Conference Series · doi:10.1088/1742-6596/1192/1/012018 · Cited by 271
“It shows that although the performance of AdaBoost is superior as reported in [4], [5], and [7], the method produces inferior performance on CIC IDS 2017 Dataset.”
BackgroundMethodInfluentialA Novel Hierarchical Intrusion Detection System Based on Decision Tree and Rules-Based Models
Ahmim, A., Maglaras, L. A., Ferrag, M. A., Derdour, M., & Janicke, H. (2019) · International Conference on Distributed Computing in Smart Systems and the Internet of Things (DCOSS-IoT) · doi:10.1109/dcoss.2019.00059 · Cited by 288
“In our experiments, we use CICIDS 2017 [17], which”
BackgroundMethodInfluentialA survey and analysis of intrusion detection models based on CSE-CIC-IDS2018 Big Data
Leevy, J. L., & Khoshgoftaar, T. M. (2020) · Journal Of Big Data · doi:10.1186/s40537-020-00382-x · Cited by 269
“Datasets such as CSE-CIC-IDS2018 [5] were created to train predictive models on anomaly-based intrusion detection for network traffic.”
BackgroundMethodA Deep CNN Ensemble Framework for Efficient DDoS Attack Detection in Software Defined Networks
Haider, S., Akhunzada, A., Mustafa, İ., Patel, T. B., Fernandez, A. S., Choo, K. R., & Iqbal, J. (2020) · IEEE Access · doi:10.1109/access.2020.2976908 · Cited by 263
“CICIDS2017 is purely a Flow-based state-of-the-art SDN dataset (additional details about the dataset are presented in Section III-A).”
BackgroundMethodInfluentialUllah, F., Ullah, S., Srivastava, G., & Lin, J. C. (2023) · Digital Communications and Networks · doi:10.1016/j.dcan.2023.03.008 · Cited by 275
DCNNBiLSTM: An Efficient Hybrid Deep Learning-Based Intrusion Detection System
Hnamte, V., & Hussain, J. (2023) · Telematics and Informatics Reports · doi:10.1016/j.teler.2023.100053 · Cited by 309
Azam, Z., Islam, M. M., & Huda, M. N. (2023) · IEEE Access · doi:10.1109/access.2023.3296444 · Cited by 265
“The dataset includes normal behaviour and information on new malware attacks, including Brute Force FTP, Brute Force SSH, DoS, Heartbleed, Web Attack, Infiltration, Botnet, and DDoS [210].”
MethodRDTIDS: Rules and Decision Tree-Based Intrusion Detection System for Internet-of-Things Networks
Ferrag, M. A., Maglaras, L. A., Ahmim, A., Derdour, M., & Janicke, H. (2020) · Future Internet · doi:10.3390/fi12030044 · Cited by 251
“Data Set and Data Pre-Processing We use two new real traffic datasets, namely the CICIDS 2017 dataset [24] and the Bot-IoT dataset [38] for the experiments.”
MethodGAN-based imbalanced data intrusion detection system
Lee, J., & Park, K. (2019) · Personal and Ubiquitous Computing · doi:10.1007/s00779-019-01332-y · Cited by 258
“We used the CICIDS 2017 dataset [16] to test the method proposed in this paper.”
MethodHybrid Deep Learning for Botnet Attack Detection in the Internet-of-Things Networks
Popoola, S. I., Adebisi, B., Hammoudeh, M. A. A., Gui, G., & Gacanin, H. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3034156 · Cited by 263
“The application of the DEFCON-8 data set is limited because of the low number of benign traffic samples [36].”
BackgroundDing, H., Chen, L., Dong, L., Fu, Z., & Cui, X. (2022) · Future Generation Computer Systems · doi:10.1016/j.future.2022.01.026 · Cited by 240
Intelligent transportation system for internet of vehicles based vehicular networks for smart cities
Rani, P., & Sharma, R. (2023) · Computers and Electrical Engineering · doi:10.1016/j.compeleceng.2022.108543 · Cited by 237
Neupane, S., Ables, J., Anderson, W. S., Mittal, S., Rahimi, S., Banicescu, I., & Seale, M. A. (2022) · IEEE Access · doi:10.1109/access.2022.3216617 · Cited by 293
“They perform experiments on three different datasets: CIDDS-001, CICIDS2017, and CICDDoS19.”
BackgroundInfluentialA fast network intrusion detection system using adaptive synthetic oversampling and LightGBM
Liu, J., Gao, Y., & Hu, F. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102289 · Cited by 231
Intrusion Detection Using Big Data and Deep Learning Techniques
Faker, O., & Doğdu, E. (2019) · ACM Southeast Conference (ACMSE) · doi:10.1145/3299815.3314439 · Cited by 228
“B-Profile system [18] is used for the abstract behavior of human interactions and to generate benign natural background traffic and CICFlowMeter [24] is used to extract the features from the dataset.”
BackgroundMethodA Framework for Malicious Traffic Detection in IoT Healthcare Environment
Hussain, F., Abbas, S. G., Shah, G. A., Pires, I. M., Fayyaz, U. U., Shahzad, F., Garcia, N. M., & Zdravevski, E. (2021) · Sensors · doi:10.3390/s21093025 · Cited by 230
“However, this dataset does not contain real-time traffic and has some irregularities like the absence of false positives [35].”
BackgroundGraph Neural Networks for Intrusion Detection: A Survey
Bilot, T., Madhoun, N. E., Agha, K. A., & Zouaoui, A. (2023) · IEEE Access · doi:10.1109/access.2023.3275789 · Cited by 294
“Experiments were conducted on the 80 original features, concluding that 8 selected features are sufficient to achieve valuable results [97].”
BackgroundLouk, M. H. L., & Tama, B. A. (2022) · Expert Systems with Applications · doi:10.1016/j.eswa.2022.119030 · Cited by 227
Kunang, Y. N., Nurmaini, S., Stiawan, D., & Suprapto, B. Y. (2021) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2021.102804 · Cited by 240
FlowTransformer: A transformer framework for flow-based network intrusion detection systems
Manocchio, L. D., Layeghy, S., Lo, W. W., Kulatilleke, G. K., Sarhan, M., & Portmann, M. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.122564 · Cited by 277
“3) CSE-CIC-IDS2018 [30], an NIDS dataset for traditional networks including ‘seven different attack scenarios: Brute-force, Heartbleed, Botnet, DoS, DDoS, Web attacks, and infiltration of the network from inside.”
BackgroundAdversarial Machine Learning Applied to Intrusion and Malware Scenarios: A Systematic Review
Martins, N., Cruz, J. M., Cruz, T., & Abreu, P. H. (2020) · IEEE Access · doi:10.1109/access.2020.2974752 · Cited by 223
Evaluation of Machine Learning Algorithms for Anomaly Detection
Elmrabit, N., Zhou, F., Li, F., & Zhou, H. (2020) · International Conference on Cyber Security and Protection of Digital Services (Cyber Security) · doi:10.1109/cybersecurity49315.2020.9138871 · Cited by 236
“Based on their discussion and our assessment, CICIDS2017 [29] and UNSW-NB15 [30] were used to evaluate the twelve ML algorithms in our current paper.”
MethodShahraki, A., Abbasi, M., & Haugen, Ø. (2020) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2020.103770 · Cited by 217
A Survey of CNN-Based Network Intrusion Detection
Mohammadpour, L., Ling, T. C., Liew, C. S., & Aryanfar, A. (2022) · Applied Sciences · doi:10.3390/app12168162 · Cited by 251
Multi-dimensional feature fusion and stacking ensemble mechanism for network intrusion detection
Zhang, H., Li, J., Liu, X.-M., et al. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2021.03.024 · Cited by 210
Le, T.-T.-H., Kim, H., Kang, H., & Kim, H. (2022) · Sensors · doi:10.3390/s22031154 · Cited by 208
“They evaluated their proposed method using the CICIDS2017 dataset.”
BackgroundElsayed, M. S., Le‐Khac, N., Albahar, M. A., & Jurcut, A. D. (2021) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2021.103160 · Cited by 209
A New Ensemble-Based Intrusion Detection System for Internet of Things
Abbas, A., Khan, M. A., Latif, S., Ajaz, M., Shah, A. A., & Ahmad, J. E. (2021) · Arabian Journal for Science and Engineering · doi:10.1007/s13369-021-06086-5 · Cited by 229
“The dataset used in this study has been created by The Canadian Institute for Cybersecurity (CIC) in 2017 [53].”
MethodIoT Intrusion Detection System Using Deep Learning and Enhanced Transient Search Optimization
Fatani, A., Elaziz, M. A., Dahou, A., Al‐qaness, M. A. A., & Lu, S. (2021) · IEEE Access · doi:10.1109/access.2021.3109081 · Cited by 227
“From these results it can be seen that the values of FPR for the TSODE are better than other algorithms in the binary and multi-class classification cases among all the tested four datasets (i.e., KDDCup-99, NSL-KDD, BoT-IOT, and CICIDS-2017).”
MethodInfluentialNetwork Intrusion Detection: Based on Deep Hierarchical Network and Original Flow Data
Zhang, Y., Chen, X., Jin, L., Wang, X., & Guo, D. (2019) · IEEE Access · doi:10.1109/access.2019.2905041 · Cited by 219
“From the experimental results on the CICIDS2017 dataset in TABLE 3, we can find that the deep hierarchical network model proposed by us has better performance than the traditional machine learning algorithm model by Sharafaldin et al. [33].”
MethodKareem, S. S., Mostafa, R. R., Hashim, F. A., & El-Bakry, H. M. (2022) · Sensors · doi:10.3390/s22041396 · Cited by 201
“This dataset has 2,830,743 records on 8 files, with each record including 78 distinct features with their label [69].”
BackgroundBukhari, S. M. S., Zafar, M. H., Houran, M. A., Moosavi, S. K. R., Mansoor, M., Muaaz, M., & Sanfilippo, F. (2024) · Ad Hoc Networks · doi:10.1016/j.adhoc.2024.103407 · Cited by 224
Feature extraction for machine learning-based intrusion detection in IoT networks
Sarhan, M., Layeghy, S., Moustafa, N., Gallagher, M. R., & Portmann, M. (2022) · Digital Communications and Networks · doi:10.1016/j.dcan.2022.08.012 · Cited by 227
“• CSE-CIC-IDS2018 : A dataset released by a collaborative project between the Communications Security Establishment (CSE) and Canadian Institute for Cybersecurity (CIC) in 2018 [29].”
BackgroundPinto, A., Herrera, L.-C., Donoso, Y., & Gutiérrez, J. (2023) · Sensors · doi:10.3390/s23052415 · Cited by 212
“[80] CICDS 2017 Generative models Quadratic discriminant analysis 0.”
InfluentialZhang, C., Costa‐Pérez, X., & Patras, P. (2022) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2021.3137084 · Cited by 219
Ali, S., Li, Q., & Yousafzai, A. (2023) · Ad Hoc Networks · doi:10.1016/j.adhoc.2023.103320 · Cited by 223
A Hybrid Intrusion Detection System Based on Scalable K-Means+ Random Forest and Deep Learning
Liu, C., Gu, Z., & Wang, J. (2021) · IEEE Access · doi:10.1109/access.2021.3082147 · Cited by 194
“The CIC-IDS2017 dataset was generated in 2017 [26] In this example, the categorical feature service is converted to numerical values in the range of [1,70] with a step size of 1.”
Method
Metadata
- Authors
- Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A.
- Affiliations
- University of New Brunswick (CA)
- University of New Brunswick (UNB), Canada
- Venue
- Proceedings of the 4th International Conference on Information Systems Security and Privacy
- Published
- 2018
- Pages
- 108-116
- OpenAlex
- W2789828921
- Cited by
- 5,318
- References
- 27
- Citations by year
- 2026: 1170 · 2025: 1032 · 2024: 803 · 2023: 704 · 2022: 558 · 2021: 518 · 2020: 332 · 2019: 165 · 2018: 35
- FWCI
- 215.46
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- cc-by-nc-nd
- Locations
- International Conference on Information Systems Security and Privacy (ICISSP) (publishedVersion, cc-by-nc-nd)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- intrusion detection, intrusion detection datasets, network traffic characterization, network security, dataset construction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
