The DOI matches its Crossref record; 20 of the 27 references it cites were found in a registry or an index.
Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization
Open accessOverview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Many studies classify feature selection methods into three categories: filter-based techniques, wrapper techniques, and embed techniques”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [210]
Citations
Cites
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396 · cited 3×
“KDD’99 (University of California, Irvine 1998-99): This dataset is an updated version of the DARPA98, by processing the tcpdump portion.”
BackgroundMethodSelf-citationTesting Intrusion detection systems
McHugh, J. (2000) · ACM Transactions on Privacy and Security · doi:10.1145/382912.382923 · Cited by 1,490 · cited 4×
“Moreover, it lacks actual attack data records (McHugh, 2000) (Brown et al.”
BackgroundMethodInfluentialToward developing a systematic approach to generate benchmark datasets for intrusion detection
Shiravi, A., Shiravi, H., Tavallaee, M., & Ghorbani, A. A. (2012) · Computers & Security · doi:10.1016/j.cose.2011.12.012 · Cited by 1,345
Self-citationCharacterization of Tor Traffic using Time based Features
Lashkari, A. H., Gil, G. D., Mamun, M., & Ghorbani, A. A. (2017) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0006105602530262 · Cited by 926 · cited 3×
“We begin to extract the 80 traffic features from the dataset using CICFlowMeter (CICFlowMeter, 2017),(Habibi Lashkari et al., 2017).”
MethodSelf-citationStatistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation
Song, J., Takakura, H., Okabe, Y., Eto, M., Inoue, D., & Nakao, K. (2011) · International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security · doi:10.1145/1978672.1978676 · Cited by 335 · cited 2×
“The normal traffic here has been simulated repeatedly during the attacks and producing only DNS and mail traffic data, which is not reflected in real world normal network traffic, so there are no false positives, which are important for minimizing the number of alerts (Song et al., 2011) (M.”
BackgroundGeneration of a new IDS test dataset: Time to retire the KDD collection
Creech, G., & Hu, J.-K. (2013) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc.2013.6555301 · Cited by 326 · cited 1×
“ADFA (University of New South Wales 2013): This dataset includes normal training and validating data and 10 attacks per vector (Creech and Hu, 2013).”
MethodTowards a Reliable Intrusion Detection Benchmark Dataset
Sharafaldin, I., Gharib, A., Lashkari, A. H., & Ghorbani, A. A. (2017) · Software Networking · doi:10.13052/jsn2445-9739.2017.009 · Cited by 309 · cited 9×
“Finally, we evaluate the quality of the generated dataset by searching for common mistakes and criticisms of other synthetically created datasets, based on the 11 criteria from the last proposed dataset evaluation framework by Canadian Institute for Cybersecurity (CIC)(Sharafaldin et al., 2017).”
MethodInfluentialSelf-citationAn Evaluation Framework for Intrusion Detection Dataset
Gharib, A., Sharafaldin, I., Lashkari, A. H., et al. (2016) · International Conferences on Information Science and System · doi:10.1109/icissec.2016.7885840 · Cited by 224 · cited 6×
“Regarding to the last dataset evaluation framework published on 2016 (Gharib et al., 2016), covering eleven criteria is necessary for each dataset.”
BackgroundMethodInfluentialSelf-citationNetwork Intrusion Detection and Prevention - Concepts and Techniques
Ghorbani, A., Lu, W., & Tavallaee, M. (2009) · Advances in Information Security · doi:10.1007/978-0-387-88771-5 · Cited by 175 · cited 1×
“Since 1999, Scott et al. (Scott and Wilkins, 1999), Heideman and Papadopulus (Heidemann and Papdopoulos, 2009), Ghorbani et al. (Ghorbani Ali and Mahbod, 2010), Nehinbe (Nehinbe, 2011), Shiravi et al. (Ali Shiravi and Ghorbani, 2012), and Sharfaldin et al. (Gharib et al., 2016) tried to propose an…”
BackgroundSelf-citationA Labeled Data Set for Flow-Based Intrusion Detection
Sperotto, A., Sadre, R., van Vliet, F., & Pras, A. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04968-2_4 · Cited by 155 · cited 1×
“It is labelled and is more realistic, but the lack of volume and diversity of attacks is obvious (Sperotto et al., 2009).”
Background
Cited by
Sorted by citations
Items 901–1,000 of 1,010
Ming, L., Han, D., Yin, X., Liu, H., & Li, D. (2021) · Security and Communication Networks · doi:10.1155/2021/7045823 · Cited by 24
PRISM: A Hierarchical Intrusion Detection Architecture for Large-Scale Cyber Networks
Javed, Y., Khayat, M., Elghariani, A., et al. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3240315 · Cited by 26
“To examine the robustness of multi-stage attack prediction mechanism of PRISM in its ability to detect a multi-stage attack and correctly predict its progression, experimentation on the CIC-2017 dataset is conducted.”
MethodInfluentialIoT Dataset Validation Using Machine Learning Techniques for Traffic Anomaly Detection
Vigoya, L., Fernández, D., Carneiro, V., et al. (2021) · Electronics · doi:10.3390/electronics10222857 · Cited by 26
1D-CNN based Model for Classification and Analysis of Network Attacks
Singh, K., Mahajan, A., & Mansotra, V. (2021) · International Journal of Advanced Computer Science and Applications · doi:10.14569/ijacsa.2021.0121169 · Cited by 30
“Dataset Description As already mentioned, the CICIDS2017 dataset, created by the Canadian Institute for Cybersecurity consists of data scattered across eight files both in pcap and csv format [33].”
MethodONOS Flood Defender: An Intelligent Approach to Mitigate DDoS Attack in SDN
Aslam, N., Srivastava, S., & Gore, M. M. (2022) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.4534 · Cited by 26
Yoshimura, N., Kuzuno, H., Shiraishi, Y., et al. (2022) · Sensors · doi:10.3390/s22124405 · Cited by 26
“Numerous methods that use feature values extracted from flows provided by open datasets have been proposed, such as NSL-KDD [13] and CIC-IDS2017 [14].”
Protocol-Specific and Sensor Network-Inherited Attack Detection in IoT Using Machine Learning
Zahra, F., Jhanjhi, N. Z., Khan, N. A., Brohi, S. N., Masud, M., & Aljahdali, S. (2022) · Applied Sciences · doi:10.3390/app122211598 · Cited by 27
DePTVM: Decentralized Pseudonym and Trust Value Management for Integrated Networks
Liu, G., Yan, Z., Wang, D., Wang, H., & Li, T. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3246799 · Cited by 28
Few-shot encrypted traffic classification via multi-task representation enhanced meta-learning
Yang, C., Xiong, G., Zhang, Q., Shi, J., Gou, G., Li, Z., & Liu, C. (2023) · Computer Networks · doi:10.1016/j.comnet.2023.109731 · Cited by 33
Unknown, Atypical and Polymorphic Network Intrusion Detection: A Systematic Survey
Sabeel, U., Heydari, S. S., El‐Khatib, K., & Elgazzar, K. (2023) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2023.3298533 · Cited by 29
Real-Time Clustering Based on Deep Embeddings for Threat Detection in 6G Networks
Paolini, E., Valcarenghi, L., Maggiani, L., et al. (2023) · IEEE Access · doi:10.1109/access.2023.3325721 · Cited by 26
“This can be compared with the best performing model in [24], that shows an F1-score of 98%, albeit working on statistics extracted on complete traffic flows which makes it unsuitable for real-time detection.”
BackgroundMethodIntrusion Detection Model for Internet of Vehicles Using GRIPCA and OWELM
Zhang, K., Yang, J., Shao, Y., et al. (2024) · IEEE Access · doi:10.1109/access.2024.3368392 · Cited by 26
Najada, H. A., Mahgoub, I., & Mohammed, I. (2018) · IEEE Symposium Series on Computational Intelligence (SSCI) · doi:10.1109/ssci.2018.8628685 · Cited by 26
“Thus, researchers must resort to datasets which they can obtain that are often suboptimal [25].”
BackgroundSystematic Review Analysis on SQLIA Detection and Prevention Approaches
Aliero, M. S., Qureshi, K. N., Pasha, M. F., et al. (2020) · Wireless Personal Communications · doi:10.1007/s11277-020-07151-2 · Cited by 26
“5 [58] S53 Conference P Y P Y 3 [59] S54 Conference P Y P Y 3 [60] S55 Conference P Y P Y 3 [61] S56 Conference P Y P Y 3 [62] S57 Conference P Y P Y 3 [63] S58 Journal P Y Y Y 3.”
BackgroundVenturi, A., Apruzzese, G., Andreolini, M., Colajanni, M., & Marchetti, M. (2020) · Data in Brief · doi:10.1016/j.dib.2020.106631 · Cited by 26
ROSPaCe: Intrusion Detection Dataset for a ROS2-Based Cyber-Physical System and IoT Networks
Puccetti, T., Nardi, S., Cinquilli, C., Zoppi, T., & Ceccarelli, A. (2024) · Scientific Data · doi:10.1038/s41597-024-03311-2 · Cited by 30
Gueye, T., Wang, Y., Rehman, M., Mushtaq, R. T., & Zahoor, S. (2023) · Cluster Computing · doi:10.1007/s10586-023-04028-4 · Cited by 27
“[23] Computer science Technical report Provide insights into the development of data-driven intrusion detection systems using this new dataset”
BackgroundLearning-based intrusion detection for high-dimensional imbalanced traffic
Gu, Y., Yu, Y., Yan, Y., et al. (2023) · Computer Communications · doi:10.1016/j.comcom.2023.10.018 · Cited by 25
A Novel Approach for Real-Time Server-Based Attack Detection Using Meta-Learning
Rustam, F., Raza, A., Qasim, M., et al. (2024) · IEEE Access · doi:10.1109/access.2024.3375878 · Cited by 25
“CICIDS 2017 [24] broadens attack scenario coverage, but has limitations.”
BackgroundSantos, K. C., Miani, R. S., & Silva, F. D. O. (2024) · Journal of Network and Systems Management · doi:10.1007/s10922-024-09813-z · Cited by 25
SPIDER: A Semi-Supervised Continual Learning-based Network Intrusion Detection System
Amalapuram, S. K., Tamma, B. R., & Channappayya, S. S. (2024) · doi:10.1109/infocom52122.2024.10621428 · Cited by 25
“These include hyperparameters selection, architecture details, baseline method selection criteria, evaluation metrics, implementation, and hardware details.”
Shafi, M., Lashkari, A. H., & Roudsari, A. H. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104160 · Cited by 27
Self-citationYan, H., Lin, X., Li, S., et al. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3516548 · Cited by 25
Poisoning and Evasion: Deep Learning-Based NIDS under Adversarial Attacks
Mohammadian, H., Lashkari, A. H., & Ghorbani, A. A. (2024) · Conference on Privacy, Security and Trust · doi:10.1109/pst62714.2024.10788064 · Cited by 32
Self-citationA Systematic Study of Adversarial Attacks Against Network Intrusion Detection Systems
Sharma, S., & Chen, Z. (2024) · Electronics · doi:10.3390/electronics13245030 · Cited by 39
FeCo: Boosting Intrusion Detection Capability in IoT Networks via Contrastive Learning
Wang, N., Shi, S., Chen, Y., Lou, W., & Hou, Y. T. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3544106 · Cited by 28
Mondragón, J. C. M., Branco, P., Jourdan, G.-V., Gutierrez-Rodríguez, A. E., & Biswal, R. R. (2025) · Applied Intelligence · doi:10.1007/s10489-025-06422-4 · Cited by 35
Erskine, S. K. (2025) · Applied System Innovation · doi:10.3390/asi8020052 · Cited by 26
“Furthermore stage was to execute intrusion a tt acks against Furthermore, the initial stage was to execute intrusion attacks against IoT devices.”
Kalakoti, R., Nõmm, S., & Bahşi, H. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111479 · Cited by 36
Machine Learning Algorithms on Botnet Traffic
McKay, R., Pendleton, B., Britt, J., et al. (2019) · International Conference on Compute and Data Analysis (ICCDA) · doi:10.1145/3314545.3314569 · Cited by 25
“[12] which listed many of the available datasets and the positives and negatives regarding each one.”
BackgroundSDN/NFV-based DDoS Mitigation via Pushback
Bülbül, N. S., & Fischer, M. (2020) · International Conference on Communications · doi:10.1109/icc40277.2020.9148717 · Cited by 24
Ramadhan, I., Sukarno, P., & Nugroho, M. A. (2020) · doi:10.1109/icoict49345.2020.9166380 · Cited by 25
“After the extraction process, the feature selection process is performed using the RandomForestRegressor method of scikit-learn, which determines the weight of each feature [9].”
MethodOn the Usage of Generative Models for Network Anomaly Detection in Multivariate Time-Series
González, G. G., Casas, P., Fernández, A., & Gómez, G. (2021) · ACM SIGMETRICS Performance Evaluation Review · doi:10.1145/3466826.3466843 · Cited by 28
“[13] and SYN-NET [15].”
A Mean Convolutional Layer for Intrusion Detection System
Mohammadpour, L., Ling, T. C., Liew, C. S., & Aryanfar, A. (2020) · Security and Communication Networks · doi:10.1155/2020/8891185 · Cited by 25
“(is paper has presented numerous experiments regarding the CICIDS2017 [13] dataset which is an intrusion detection as well as prevention dataset.”
BackgroundMethodInfluentialZhou, K., Wang, W., Hu, T., & Deng, K. (2021) · Entropy · doi:10.3390/e23030274 · Cited by 27
“We also tested the latest dataset of [57] ’CIC-IDS-2017’ (https://www.”
MethodSTIDM: A Spatial and Temporal Aware Intrusion Detection Model
Han, X., Yin, R., Lü, Z., Jiang, B., Liu, Y., Liu, S., Wang, C., & Li, N. (2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00058 · Cited by 26
“The experimental results of traditional machine learning methods on the two datasets come from literature [13], [19].”
MethodEvidential classification and feature selection for cyber-threat hunting
Beechey, M., Kyriakopoulos, K. G., & Lambotharan, S. (2021) · Knowledge-Based Systems · doi:10.1016/j.knosys.2021.107120 · Cited by 28
On the Evaluation of Sequential Machine Learning for Network Intrusion Detection
Corsini, A., Yang, S. J., & Apruzzese, G. (2021) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3465481.3470065 · Cited by 27
“We do not consider works whose proposal is evaluated exclusively on the (outdated andwidely deprecated [26]) NSLKDDdataset (e.”
BackgroundFeature Selection Evaluation towards a Lightweight Deep Learning DDoS Detector
Sanchez, O. R., Repetto, M., Carrega, A., Bolla, R., & Pajo, J. F. (2021) · International Conference on Communications · doi:10.1109/icc42927.2021.9500458 · Cited by 27
“CICIDS 2017 [11] 07/07/2017 05/07/2017 05/07/2017 05/07/2017 05/07/2017 LOIC (TCP) Hulk GoldenEye slowloris SlowHTTPtest 128025 231073 10293 5796 5499 97686 440031 -”
BackgroundMethodInfluentialAttack Categorisation for IoT Applications in Critical Infrastructures, a Survey
Staddon, E., Loscrì, V., & Mitton, N. (2021) · Applied Sciences · doi:10.3390/app11167228 · Cited by 25
Federated Reinforcement Learning-Supported IDS for IoT-steered Healthcare Systems
Otoum, S., Guizani, N., & Mouftah, H. T. (2021) · International Conference on Communications · doi:10.1109/icc42927.2021.9500698 · Cited by 25
“The CICIDS2017 dataset was published in 2017, consists of normal and attacks records [20].”
MethodEfficient Intrusion Detection System for SDN Orchestrated Internet of Things
Zeleke, E. M., Melaku, H. M., & Mengistu, F. G. (2021) · Journal of Computer Networks and Communications · doi:10.1155/2021/5593214 · Cited by 25
“CICIDS2017 meets all of them [31].”
MethodIntrusion Detection Systems Based on Logarithmic Autoencoder and XGBoost
Xu, W., & Fan, Y. (2022) · Security and Communication Networks · doi:10.1155/2022/9068724 · Cited by 25
“CICIDS2017 was proposed by the Canadian Cyber Security Institute to tease out the limitations of existing data sets and provide a realistic and reliable data set for intrusion detection [18].”
BackgroundHandling class Imbalance problem in Intrusion Detection System based on deep learning
Mbow, M., Koide, H., & Sakurai, K. (2022) · International Journal of Networking and Computing · doi:10.15803/ijnc.12.2_467 · Cited by 26
GLD-Net: Deep Learning to Detect DDoS Attack via Topological and Traffic Feature Fusion
Guo, W., Qiu, H., Liu, Z., Zhu, J., & Wang, Q. (2022) · Computational Intelligence and Neuroscience · doi:10.1155/2022/4611331 · Cited by 26
“Its traffic composition is shown in Table 2, where the bold characters indicate the attack types of the training data. second dataset, CIC-IDS2017, was developed by Sharafaldin et al. [59] to implement real network traffic collection based on user behavior simulation.”
BackgroundFeature Selection by Improved Sand Cat Swarm Optimizer for Intrusion Detection
Jovanović, D., Marjanovic, M., Antonijević, M., et al. (2022) · International Conference on Artificial Intelligence in Everything (AIE) · doi:10.1109/aie57029.2022.00134 · Cited by 25
“Additionally, the HSCSO has been compared to several other cutting-edge methods, validated under the same experimental conditions over two benchmark datasets, namely CICIDS-2017 and UNSW-NB15.”
BackgroundMethodInfluentialShiomoto, K. (2022) · Journal of Network and Systems Management · doi:10.1007/s10922-022-09698-w · Cited by 25
BAE: Anomaly Detection Algorithm Based on Clustering and Autoencoder
Wang, D., Nie, M., & Chen, D. (2023) · Mathematics · doi:10.3390/math11153398 · Cited by 26
“The Accuracy, Recall, Precision, and F-score are employed for the evaluation, and comparative experiments are conducted on four datasets: KDDCUP99 [24], UNSW-NB15 [25], CICIDS2017 [26], and NSL-KDD [27].”
MethodInfluentialToward Continuous Threat Defense: in-Network Traffic Analysis for IoT Gateways
Zang, M., Zheng, C., Dittmann, L., & Zilberman, N. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3323771 · Cited by 28
“Digests sent to the control plane by calling SendDigestEntry function in p4runtime_lib [23].”
Enhanced CNN-LSTM Deep Learning for SCADA IDS Featuring Hurst Parameter Self-Similarity
Balla, A., Habaebi, M. H., Elsheikh, E. A. A., et al. (2024) · IEEE Access · doi:10.1109/access.2024.3350978 · Cited by 25
“To build a data-driven foundation for our security models, we undertook an extensive Exploratory Data Analysis (EDA) on the CICIDS2017 dataset [6].”
BackgroundMethodComparison of Network Intrusion Detection Performance Using Feature Representation
Pérez, D., Alonso, S., Morán, A., Prada, M. A., Fuertes, J. J., & Domínguez, M. (2019) · Communications in computer and information science · doi:10.1007/978-3-030-20257-6_40 · Cited by 25
On the Impact of Network Data Balancing in Cybersecurity Applications
Pawlicki, M., Choraś, M., Kozik, R., & Hołubowicz, W. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-50423-6_15 · Cited by 26
“Firstly, in the case of the CICIDS2017 dataset, random subsampling was just as good or better than other undersampling methods and the results were on par with Bor-derline SMOTE.”
BackgroundInfluentialCo-Maintained Database Based on Blockchain for IDSs: A Lifetime Learning Framework
Liang, J., & Ma, M. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3064607 · Cited by 25
“Three recent datasets, i.e., CICIDS 2017, NDSec-1 and TUIDS [39], [40], [41], are used in the simulation.”
MethodInfluentialAttacks Detection in 6G Wireless Networks using Machine Learning
Saeed, M. M. A., Saeed, R. A., Gaid, A. S. A., et al. (2023) · International Conference on Computer and Communication Engineering · doi:10.1109/iccce58854.2023.10246078 · Cited by 24
Koumar, J., Hynek, K., Pešek, J., & Čejka, T. (2024) · Computer Networks · doi:10.1016/j.comnet.2023.110147 · Cited by 25
Djaidja, T. E. T., Brik, B., Boualouache, A., Senouci, S., & Ghamri-Doudane, Y. M. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103707 · Cited by 26
Buzzio-García, J., Vergara, J., Ríos-Guiral, S., Garzón, C., Gutiérrez, S. A., Botero, J. F., Quiroz-Arroyo, J. L., & Pérez-Díaz, J. A. (2024) · IEEE Access · doi:10.1109/access.2024.3378271 · Cited by 24
“It is widely recognized for training machine learning and artificial intelligence models for network attack detection [33].”
BackgroundAddressing Concept Drift in IoT Anomaly Detection: Drift Detection, Interpretation, and Adaptation
Xu, L., Han, Z., Zhao, D., et al. (2024) · IEEE Transactions on Sustainable Computing · doi:10.1109/tsusc.2024.3386667 · Cited by 24
“In the following experiments, three datasets were employed, namely SWaT [32], BATADAL [33], and CICIDS2017 [34].”
Termos, M., Ghalmane, Z., Brahmia, M., Fadlallah, A., Jaber, A. H., & Zghal, M. (2024) · Internet of Things · doi:10.1016/j.iot.2024.101214 · Cited by 24
Multi-objective evolutionary neural architecture search for network intrusion detection
Lin, Q., Liu, Z., Yang, Y., et al. (2024) · Swarm and Evolutionary Computation · doi:10.1016/j.swevo.2024.101702 · Cited by 24
Few-Shot Class-Incremental Learning for Network Intrusion Detection Systems
Monda, D. D., Montieri, A., Persico, V., et al. (2024) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3481895 · Cited by 27
“Such differences are also reflected in intrusion detection datasets [43], [44], [45], which commonly separate DoS and DDoS attack labels.”
BackgroundA Temporal Convolutional Network-Based Approach for Network Intrusion Detection
Nazre, R., Budke, R., Oak, O., et al. (2024) · International Conference on Integrated Intelligence and Communication Systems (ICIICS) · doi:10.1109/iciics63763.2024.10860234 · Cited by 24
“Existing work on IDS in IoT environments has been centered primarily around specific attacks like DDoS [14] using datasets such as IoT-23 [15] and CIC-IDS2018 [16].”
Federated RNN for Intrusion Detection System in IoT Environment Under Adversarial Attack
Rezaie, H., Taheri, R., Jordanov, I., & Shojafar, M. (2025) · Journal of Network and Systems Management · doi:10.1007/s10922-025-09963-8 · Cited by 25
Li, S., Chen, B., Li, Y., et al. (2026) · doi:10.1109/isbdas69350.2026.11484374 · Cited by 24
“We use the CICIDS2017 dataset [14], containing approximately 2.8 million labeled network flow records across 78 features.”
InfluentialCompression Analytics for Classification and Anomaly Detection Within Network Communication
Ting, C. L., Field, R. V., Fisher, A., & Bauer, T. (2018) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2018.2878172 · Cited by 24
“Further information about the dataset is discussed in [32] and [33].”
BackgroundIntrusion Detection based on Graph oriented Big Data Analytics
Abid, A., & Jemili, F. (2020) · Procedia Computer Science · doi:10.1016/j.procs.2020.08.059 · Cited by 24
“In the literature [45] [46], we find hundreds of publicly available datasets for intrusion detection, and they are widely used.”
BackgroundBharati, M. P., & Tamane, S. (2020) · doi:10.1109/icsidempc49020.2020.9299584 · Cited by 24
Saeed, A. A., & Jameel, N. G. M. (2021) · International Journal of Advances in Intelligent Informatics · doi:10.26555/ijain.v7i1.553 · Cited by 29
“The dataset is a combination of three datasets established by a cyber-security institute in Canada (CCI) [16][17].”
MethodIntelligent Intrusion Detection System for a Group of UAVs
Сергеевна, Б. Е., Lapina, M., Mudruk, N. N., & Abramov, E. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-78811-7_22 · Cited by 30
Multi-Task Hierarchical Learning Based Network Traffic Analytics
Barut, O., Luo, Y., Zhang, T., Weigang, L., & Li, P. (2021) · International Conference on Communications · doi:10.1109/icc42927.2021.9500546 · Cited by 29
“traffic captures from well-known CICIDS2017 dataset [12].”
BackgroundMethodInfluentialMokbal, F. M. M., Wang, D., Osman, M. O. M., et al. (2022) · The International Arab Journal of Information Technology · doi:10.34028/iajit/19/2/11 · Cited by 24
“…eleven criteria such as complete interaction, Complete Network configuration, complete traffic, labeled dataset, complete capture, available protocols, attack diversity, heterogeneity, feature set, and meta-data as described in [4, 22], which make it an accurate and the complete dataset to date.”
BackgroundMethodTwo-Stage Intelligent Model for Detecting Malicious DDoS Behavior
Li, M., Zhou, H., & Qin, Y. (2022) · Sensors · doi:10.3390/s22072532 · Cited by 25
“In addition, [11,12] introduced the network topology and traffic generation mode creating self-generated datasets and studied how to use attack tools to generate DDoS attacks datasets on the experimental attack and defense platform, respectively.”
HDFEF: A hierarchical and dynamic feature extraction framework for intrusion detection systems
Li, Y., Qin, T., Huang, Y., et al. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102842 · Cited by 24
Analysis and Detection against Network Attacks in the Overlapping Phenomenon of Behavior Attribute
Xie, J., Li, S., Zhang, Y., et al. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102867 · Cited by 24
Ensemble-based Intrusion Detection for Internet of Things Devices
Danso, P. K., Neto, E. C. P., Dadkhah, S., Zohourian, A., Molyneaux, H., & Ghorbani, A. A. (2022) · IEEE International Conference on Smart Communities: Improving Quality of Life using AI, Robotics and IoT (HONET) · doi:10.1109/honet56683.2022.10019140 · Cited by 28
Self-citationAlshahrani, M. M. (2023) · Applied Sciences · doi:10.3390/app13179822 · Cited by 31
Protić, D. D., Stankovic, M. S., Prodanović, R., et al. (2023) · Electronics · doi:10.3390/electronics12194158 · Cited by 24
Üstebay, S., Turgut, Z., & Aydın, M. A. (2019) · Communications in computer and information science · doi:10.1007/978-3-030-21952-9_11 · Cited by 24
Selection and Performance Analysis of CICIDS2017 Features Importance
Reis, B., Maia, E., & Praça, I. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-45371-8_4 · Cited by 24
LSTM-based Network Attack Detection: Performance Comparison by Hyper-parameter Values Tuning
Hossain, M. D., Ochiai, H., Fall, D., & Kadobayashi, Y. (2020) · IEEE International Conference on Cyber Security and Cloud Computing / IEEE International Conference on Edge Computing and Scalable Cloud (CSCloud/EdgeCom) · doi:10.1109/cscloud-edgecom49738.2020.00020 · Cited by 29
“The CICIDS2017 dataset is widely used for network attack detection [16].”
MethodReal-Time Network Packet Classification Exploiting Computer Vision Architectures
Paolini, E., Valcarenghi, L., Maggiani, L., & Andriolli, N. (2024) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3363082 · Cited by 23
“The study only focuses on the CIC-IDS 2017 dataset [22], which cannot be considered as a good benchmark for a 5G/6G scenario because the dataset has not been collected in a real 5G network and thus the packet characteristics, e.g., packet inter-arrival time, can be very different with respect to…”
BackgroundMethodA Lightweight Cooperative Intrusion Detection System for RPL-based IoT
Azzaoui, H., Boukhamla, A. Z. E., Perazzo, P., et al. (2024) · Wireless Personal Communications · doi:10.1007/s11277-024-11009-2 · Cited by 23
“It is the most complete and up-to-date dataset, according to Sharafal-din et al. [42].”
NIDS-Vis: Improving the generalized adversarial robustness of network intrusion detection system
He, K., Kim, D. S., & Asghar, M. R. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104028 · Cited by 23
Kumar, P., Javeed, D., Islam, A. K. M. N., et al. (2024) · Decision Support Systems · doi:10.1016/j.dss.2024.114351 · Cited by 23
Machine Learning-Based Attack Detection for the Internet of Things
Bikila, D. D., & Čapek, J. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.107630 · Cited by 23
Consensus hybrid ensemble machine learning for intrusion detection with explainable AI
Ahmed, U., Jiangbin, Z., Khan, S., & Sadiq, M. T. (2024) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2024.104091 · Cited by 25
Benfarhat, I., Goh, V. T., Lim, S. C., Sheraz, M., & Chuah, T. C. (2025) · IEEE Access · doi:10.1109/access.2025.3529526 · Cited by 24
Deep PackGen: A Deep Reinforcement Learning Framework for Adversarial Network Packet Generation
Hore, S., Ghadermazi, J., Paudel, D., Shah, A., Das, T. K., & Bastian, N. D. (2025) · ACM Transactions on Privacy and Security · doi:10.1145/3712307 · Cited by 42
Advancements in Machine Learning-Based Intrusion Detection in IoT: Research Trends and Challenges
Bankó, M. B., Dyszewski, S., Králová, M., Limpek, M. B., Παπαϊωάννου, Μ., Choudhary, G., & Dragoni, N. (2025) · Algorithms · doi:10.3390/a18040209 · Cited by 26
“In the case of CIC-IDS2017 [89], it is the first IDS dataset that the CIC created, back in 2017.”
Ahsan, M. S., Islam, S., & Shatabda, S. (2025) · Swarm and Evolutionary Computation · doi:10.1016/j.swevo.2025.101984 · Cited by 31
“Additionally, the BoT-IoT [142] and CICIDS-2017 [143] datasets are widely used as well.”
Han, L., Sheng, Y., & Zeng, X. (2019) · IEEE Access · doi:10.1109/access.2019.2924492 · Cited by 26
“We evaluate our model with ISC-2012 [65] and ISC2017 [66] data sets.”
BackgroundMethodAn Overview of DoS and DDoS Attack Detection Techniques
Gniewkowski, M. (2020) · Advances in intelligent systems and computing · doi:10.1007/978-3-030-48256-5_23 · Cited by 23
Flow-Data Gathering Using NetFlow Sensors for Fitting Malicious-Traffic Detection Models
Campazas, A., Crespo-Martínez, I. S., Guerrero‐Higueras, Á. M., & Fernández, C. (2020) · Sensors · doi:10.3390/s20247294 · Cited by 23
“Labeled flows for machine- and deep-learning purposes are publicly available to researchers [24].”
BackgroundDDoS attack detection and defense in SDN based on machine learning
Luong, T.-K., Tran, T.-D., & Le, G.-T. (2020) · NAFOSTED Conference on Information and Computer Science (NICS) · doi:10.1109/nics51282.2020.9335867 · Cited by 23
“However, after 2012, the Canadian Institute for Cybersecurity in University of New Brunswick released three large-scale datasets in computer security in 2012, 2017, and 2018 called ISCXIDS2012 [12], CIC-IDS2017 [13], and CSE-CIC-IDS2018 on AWS [14] respectively.”
Few-Shot Class-Adaptive Anomaly Detection with Model-Agnostic Meta-Learning
Feng, T., Qi, Q., Wang, J., et al. (2021) · IFIP Networking Conference (IFIP Networking) · doi:10.23919/ifipnetworking52078.2021.9472814 · Cited by 23
“CICIDS2017 [36].”
MIND: A Multi-Source Data Fusion Scheme for Intrusion Detection in Networks
Anjum, N., Latif, Z., Lee, C., et al. (2021) · Sensors · doi:10.3390/s21144941 · Cited by 24
“Several public datasets are available for network IDS such as KDD CUP99 [31], NSL-KDD [27], Kyoto 2006 [32], UNSW-NB15 [28], NGIDS-DS [33], ISOT [34], TRAIbID [35], and CICIDS 2017 [36].”
MethodCREME: A toolchain of automatic dataset collection for machine learning in intrusion detection
Bui, H.-K., Lin, Y., Hwang, R., Lin, P., Nguyen, V.-L., & Lai, Y. (2021) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2021.103212 · Cited by 24
“Gharib et al. (2016) and Sharafaldin et al. (2018) introduce several more evaluation metrics such as network configuration, traffic coverage, labeled dataset, available protocols, attack diversity, anonymity, heterogeneity, feature set, and metadata.”
BackgroundFrom CIC-IDS2017 to LYCOS-IDS2017: A corrected dataset for better performance
Rosay, A., Carlier, F., Cheval, E., & Leroux, P. (2021) · IEEE/WIC/ACM International Conference on Web Intelligence · doi:10.1145/3486622.3493973 · Cited by 25
“These characteristics were used to create CIC-IDS2017 [15], a dataset released by the CIC.”
MethodA Hybrid Model for Intrusion Detection in IoT Applications
Alghamdi, M. (2022) · Wireless Communications and Mobile Computing · doi:10.1155/2022/4553502 · Cited by 23
“Figure 8 depicts the ROC analysis of the PO-CFNN technique on the UNSWNB15 dataset [26].”
MethodKurniabudi, K., Stiawan, D., Darmawijoyo, et al. (2022) · Journal of Computational Science · doi:10.1016/j.jocs.2022.101833 · Cited by 23
Metadata
- Authors
- Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A.
- Affiliations
- University of New Brunswick (CA)
- University of New Brunswick (UNB), Canada
- Venue
- Proceedings of the 4th International Conference on Information Systems Security and Privacy
- Published
- 2018
- Pages
- 108-116
- OpenAlex
- W2789828921
- Cited by
- 5,318
- References
- 27
- Citations by year
- 2026: 1170 · 2025: 1032 · 2024: 803 · 2023: 704 · 2022: 558 · 2021: 518 · 2020: 332 · 2019: 165 · 2018: 35
- FWCI
- 215.46
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- cc-by-nc-nd
- Locations
- International Conference on Information Systems Security and Privacy (ICISSP) (publishedVersion, cc-by-nc-nd)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- intrusion detection, intrusion detection datasets, network traffic characterization, network security, dataset construction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
