The DOI matches its Crossref record; 20 of the 27 references it cites were found in a registry or an index.
Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization
Open accessOverview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Many studies classify feature selection methods into three categories: filter-based techniques, wrapper techniques, and embed techniques”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [210]
Citations
Cites
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396 · cited 3×
“KDD’99 (University of California, Irvine 1998-99): This dataset is an updated version of the DARPA98, by processing the tcpdump portion.”
BackgroundMethodSelf-citationTesting Intrusion detection systems
McHugh, J. (2000) · ACM Transactions on Privacy and Security · doi:10.1145/382912.382923 · Cited by 1,490 · cited 4×
“Moreover, it lacks actual attack data records (McHugh, 2000) (Brown et al.”
BackgroundMethodInfluentialToward developing a systematic approach to generate benchmark datasets for intrusion detection
Shiravi, A., Shiravi, H., Tavallaee, M., & Ghorbani, A. A. (2012) · Computers & Security · doi:10.1016/j.cose.2011.12.012 · Cited by 1,345
Self-citationCharacterization of Tor Traffic using Time based Features
Lashkari, A. H., Gil, G. D., Mamun, M., & Ghorbani, A. A. (2017) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0006105602530262 · Cited by 926 · cited 3×
“We begin to extract the 80 traffic features from the dataset using CICFlowMeter (CICFlowMeter, 2017),(Habibi Lashkari et al., 2017).”
MethodSelf-citationStatistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation
Song, J., Takakura, H., Okabe, Y., Eto, M., Inoue, D., & Nakao, K. (2011) · International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security · doi:10.1145/1978672.1978676 · Cited by 335 · cited 2×
“The normal traffic here has been simulated repeatedly during the attacks and producing only DNS and mail traffic data, which is not reflected in real world normal network traffic, so there are no false positives, which are important for minimizing the number of alerts (Song et al., 2011) (M.”
BackgroundGeneration of a new IDS test dataset: Time to retire the KDD collection
Creech, G., & Hu, J.-K. (2013) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc.2013.6555301 · Cited by 326 · cited 1×
“ADFA (University of New South Wales 2013): This dataset includes normal training and validating data and 10 attacks per vector (Creech and Hu, 2013).”
MethodTowards a Reliable Intrusion Detection Benchmark Dataset
Sharafaldin, I., Gharib, A., Lashkari, A. H., & Ghorbani, A. A. (2017) · Software Networking · doi:10.13052/jsn2445-9739.2017.009 · Cited by 309 · cited 9×
“Finally, we evaluate the quality of the generated dataset by searching for common mistakes and criticisms of other synthetically created datasets, based on the 11 criteria from the last proposed dataset evaluation framework by Canadian Institute for Cybersecurity (CIC)(Sharafaldin et al., 2017).”
MethodInfluentialSelf-citationAn Evaluation Framework for Intrusion Detection Dataset
Gharib, A., Sharafaldin, I., Lashkari, A. H., et al. (2016) · International Conferences on Information Science and System · doi:10.1109/icissec.2016.7885840 · Cited by 224 · cited 6×
“Regarding to the last dataset evaluation framework published on 2016 (Gharib et al., 2016), covering eleven criteria is necessary for each dataset.”
BackgroundMethodInfluentialSelf-citationNetwork Intrusion Detection and Prevention - Concepts and Techniques
Ghorbani, A., Lu, W., & Tavallaee, M. (2009) · Advances in Information Security · doi:10.1007/978-0-387-88771-5 · Cited by 175 · cited 1×
“Since 1999, Scott et al. (Scott and Wilkins, 1999), Heideman and Papadopulus (Heidemann and Papdopoulos, 2009), Ghorbani et al. (Ghorbani Ali and Mahbod, 2010), Nehinbe (Nehinbe, 2011), Shiravi et al. (Ali Shiravi and Ghorbani, 2012), and Sharfaldin et al. (Gharib et al., 2016) tried to propose an…”
BackgroundSelf-citationA Labeled Data Set for Flow-Based Intrusion Detection
Sperotto, A., Sadre, R., van Vliet, F., & Pras, A. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04968-2_4 · Cited by 155 · cited 1×
“It is labelled and is more realistic, but the lack of volume and diversity of attacks is obvious (Sperotto et al., 2009).”
Background
Cited by
Sorted by citations
Items 101–200 of 1,010
A Novel Two-Stage Deep Learning Model for Network Intrusion Detection: LSTM-AE
Hnamte, V., Nguyen, H. N., Hussain, J., & Kim, Y. (2023) · IEEE Access · doi:10.1109/access.2023.3266979 · Cited by 238
“Other IDS datasets, such as NSL-KDD [47] or UNSW-NB15 [48], have a limited number of features; for example, NSL-KDD has 42 features [47]; UNSW-NB15 contains 49 features [48]; while CICIDS-2017 contains more than 80 features [49].”
MethodFed-ANIDS: Federated learning for anomaly-based network intrusion detection systems
Idrissi, M. J., Alami, H., Mahdaouy, A. E., et al. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.121000 · Cited by 191
Cyber threat detection based on artificial neural networks using event profiles
Lee, J., Kim, J., Kim, I., & Han, K. (2019) · IEEE Access · doi:10.1109/access.2019.2953095 · Cited by 188
“For the evaluation of performance, we performed a performance comparison using two benchmark datasets (NSLKDD, CICIDS2017) and two datasets collected in the real world.”
BackgroundInfluentialHuang, S., & Lei, K. (2020) · Ad Hoc Networks · doi:10.1016/j.adhoc.2020.102177 · Cited by 198
Deep Learning in IoT Intrusion Detection
Tsimenidis, S., Λάγκας, Θ., & Rantos, K. (2021) · Journal of Network and Systems Management · doi:10.1007/s10922-021-09621-9 · Cited by 207
“These models are fine-tuned to yield maximum results on obsolete data [100], while the current landscape could require different models.”
BackgroundA Flow-Based Anomaly Detection Approach With Feature Selection Method Against DDoS Attacks in SDNs
Elsayed, M. S., Le‐Khac, N., Azer, M. A., & Jurcut, A. D. (2022) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2022.3186331 · Cited by 193
“, InSDN [14], CICIDS2017 [15] and CICIDS2018 [15].”
BackgroundInfluentialYang, Y., Zheng, K., Wu, B., Yang, Y., & Wang, X. (2020) · IEEE Access · doi:10.1109/access.2020.2977007 · Cited by 193
Han, D., Wang, Z., Zhong, Y. C., Chen, W., Yang, J., Lu, S., Shi, X., & Xia, Y. Y. (2021) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2021.3087242 · Cited by 211
“We use VMs and Dockers to simulate the experimental testbed for each traffic set by referring to their papers [4], [56].”
BackgroundMethodSecurity issues in Internet of Vehicles (IoV): A comprehensive survey
Taslimasa, H., Dadkhah, S., Neto, E. C. P., Xiong, P., Ray, S., & Ghorbani, A. A. (2023) · Internet of Things · doi:10.1016/j.iot.2023.100809 · Cited by 187
Self-citationCyberattacks Detection in IoT-Based Smart City Applications Using Machine Learning Techniques
Rashid, M. M., Kamruzzaman, J., Hassan, M. M., Imam, T., & Gordon, S. (2020) · International Journal of Environmental Research and Public Health · doi:10.3390/ijerph17249347 · Cited by 189
“We used the UNSW-NB15 [27] and CICIDS2017 [31] datasets.”
MethodAnomaly-based intrusion detection system for IoT application
Bhavsar, M., Roy, K., Kelly, J. C., & Odeyomi, O. T. (2023) · Discover Internet of Things · doi:10.1007/s43926-023-00034-5 · Cited by 213
“It was developed within an emulated environment at the Canadian Institute for Cybersecurity (CIC), University of New Brunswick, Canada [128].”
BackgroundMarir, N., Wang, H., Feng, G., Li, B., & Jia, M. (2018) · IEEE Access · doi:10.1109/access.2018.2875045 · Cited by 184
Troubleshooting an Intrusion Detection Dataset: the CICIDS2017 Case Study
Engelen, G., Rimmer, V., & Joosen, W. (2021) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw53761.2021.00009 · Cited by 184
Gumusbas, D., Yıldırım, T., Genovese, A., & Scotti, F. (2020) · IEEE Systems Journal · doi:10.1109/jsyst.2020.2992966 · Cited by 192
“Among the criteria considered in [54] and [137], attack and traffic diversity play a major role, since a limited diversity or a high imbalance among attack types might increase the bias of detection approaches toward specific situations.”
BackgroundMethodInfluentialInternet of Things (IoT) security dataset evolution: Challenges and future directions
Kaur, B., Dadkhah, S., Shoeleh, F., Neto, E. C. P., Xiong, P., Iqbal, S., Lamontagne, P., Ray, S., & Ghorbani, A. A. (2023) · Internet of Things · doi:10.1016/j.iot.2023.100780 · Cited by 188
Self-citationFatani, A., Dahou, A., Al‐qaness, M. A. A., Lu, S., & Elaziz, M. A. (2021) · Sensors · doi:10.3390/s22010140 · Cited by 182
“CICIDS-2017: The CICIDS-2017 [61] dataset is a collection of network traffic samples collected in CIC (The Canadian Institute for Cybersecurity at the University of New Brunswick.”
BackgroundInfluentialDefending network intrusion detection systems against adversarial evasion attacks
Pawlicki, M., Choraś, M., & Kozik, R. (2020) · Future Generation Computer Systems · doi:10.1016/j.future.2020.04.013 · Cited by 192
A Deep Learning-Based Intrusion Detection System for MQTT Enabled IoT
Khan, M. A., Khan, M. A., Jan, S. U., Ahmad, J. E., Jamal, S. S., Shah, A. A., Pitropakis, N., & Buchanan, W. J. (2021) · Sensors · doi:10.3390/s21217016 · Cited by 203
Zero-day attack detection: a systematic literature review
Ahmad, R., Alsmadi, I. M., Al-Hamdani, W. A., & Tawalbeh, L. (2023) · Artificial Intelligence Review · doi:10.1007/s10462-023-10437-z · Cited by 228
Imtiaz, S. I., Rehman, S. U., Javed, A. R., et al. (2020) · Future Generation Computer Systems · doi:10.1016/j.future.2020.10.008 · Cited by 180
Qazi, E.-U.-H., Almorjan, A., & Zia, T. A. (2022) · Applied Sciences · doi:10.3390/app12167986 · Cited by 185
Deep learning for cyber threat detection in IoT networks: A review
Aldhaheri, A., Alwahedi, F., Ferrag, M. A., & Battah, A. A. (2023) · Internet of Things and Cyber-Physical Systems · doi:10.1016/j.iotcps.2023.09.003 · Cited by 206
Vijayanand, R., Devaraj, D., & Kannapiran, B. (2018) · Computers & Security · doi:10.1016/j.cose.2018.04.010 · Cited by 187
Alotaibi, A., & Rassam, M. A. (2023) · Future Internet · doi:10.3390/fi15020062 · Cited by 227
“On the other hand, some researchers have mentioned some methods for hardening the ML-based IDS against these attacks, but there are no experiments on these defenses in the adversarial attacks against the IDS section.”
A GRU deep learning system against attacks in software defined networks
de Assis, M. V. O., Carvalho, L. F., Lloret, J., & Proença, M. L. (2020) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2020.102942 · Cited by 185
Tama, B. A., & Lim, S. (2020) · Computer Science Review · doi:10.1016/j.cosrev.2020.100357 · Cited by 172
“• CICIDS 2017 [173] The CICIDS 2017 dataset was obtained by generating realistic benign background traffic using B-profile system.”
MethodIntrusion detection based on Machine Learning techniques in computer networks
Dina, A. S., & Manivannan, D. (2021) · Internet of Things · doi:10.1016/j.iot.2021.100462 · Cited by 201
Gyamfi, E., & Jurcut, A. D. (2022) · Sensors · doi:10.3390/s22103744 · Cited by 225
“According to the authors [200], the dataset was based on five days of normal and attacks traffic data.”
BackgroundMethodMulti-Task Network Anomaly Detection using Federated Learning
Zhao, Y., Chen, J., Wu, D., Teng, J., & Yu, S. (2019) · International Symposium on Information and Communication Technology · doi:10.1145/3368926.3369705 · Cited by 186
“In this paper, we used three representative datasets of real-world traffic, CICIDS2017, ISCXVPN2016, and ISCXTor2016, to evaluate the proposed MT-DNN-FL.”
BackgroundInfluentialA Comprehensive Systematic Literature Review on Intrusion Detection Systems
Ozkan-Okay, M., Samet, R., Aslan, Ö., & Gupta, D. (2021) · IEEE Access · doi:10.1109/access.2021.3129336 · Cited by 170
“Snort captures the network traffic and analyzes the captured traffic to detect attacks in real-time [126].”
BackgroundBoualouache, A., & Engel, T. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3236448 · Cited by 179
“The model was trained based on the CICIDS2017 dataset using RF and a variation of Kmeans and evaluated using F1-score and accuracy metrics.”
BackgroundInfluentialAn Intelligent Intrusion Detection System for Smart Consumer Electronics Network
Javeed, D., Saeed, M. S., Ahmad, I., Kumar, P., Jolfaei, A., & Tahir, M. A. (2023) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2023.3277856 · Cited by 177
Yang, Y., Zheng, K., Wu, C., Niu, X., & Yang, Y. (2019) · Applied Sciences · doi:10.3390/app9020238 · Cited by 167
“Currently, only few public benchmarks in the intrusion detection domain can be utilized to evaluate the performance of the IDS, such as KDD Cup 99 [46,47], NSL-KDD [21,22], UNSW-NB15 [25–27], ADFA [48], Kyoto 2006+ [49], ISCXIDS2012 [50], and CICIDS2017 [51].”
BackgroundA Detailed Analysis of the CICIDS2017 Data Set
Sharafaldin, I., Lashkari, A. H., & Ghorbani, A. A. (2019) · Communications in computer and information science · doi:10.1007/978-3-030-25109-3_9 · Cited by 166
Self-citationGupta, N., Jindal, V., & Bedi, P. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102499 · Cited by 176
Applying big data based deep learning system to intrusion detection
Zhong, W., Yu, N., & Ai, C. (2020) · Big Data Mining and Analytics · doi:10.26599/bdma.2020.9020003 · Cited by 169
“DARPA1998 [42] , ISCX2012 [16] , and CICIDS2017 [43] are only public benchmark datasets containing raw traffic data with both labeled benign and intrusive samples.”
BackgroundAutoencoder-based deep metric learning for network intrusion detection
Andresini, G., Appice, A., & Malerba, D. (2021) · Information Sciences · doi:10.1016/j.ins.2021.05.016 · Cited by 177
Jin, D., Lu, Y., Qin, J., Cheng, Z., & Mao, Z. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101984 · Cited by 169
Makhadmeh, S. N., Fraihat, S., Awad, M., Sanjalawe, Y. K., Al‐Betar, M. A., & Awadallah, M. A. (2025) · Internet of Things · doi:10.1016/j.iot.2025.101536 · Cited by 172
Panigrahi, R., Borah, S., Bhoi, A. K., Ijaz, M. F., Pramanik, M., Kumar, Y., & Jhaveri, R. H. (2021) · Mathematics · doi:10.3390/math9070751 · Cited by 176
Clustering based semi-supervised machine learning for DDoS attack classification
Aamir, M., & Zaidi, S. M. A. (2019) · Journal of King Saud University - Computer and Information Sciences · doi:10.1016/j.jksuci.2019.02.003 · Cited by 161
“The four most important features of classification among 78 total variables, as mentioned by the dataset creators in (Sharafaldin et al., 2018) through preliminary examination, are taken into consideration i.e. ‘Bwd Packet Length Std’, ‘Average Packet Size’, ‘Flow Duration’, and ‘Flow IAT Std’.”
Hybrid approach to intrusion detection in fog-based IoT environments
de Souza, C. A., Westphall, C. B., Machado, R. B., Sobral, J. B. M., & Vieira, G. D. S. (2020) · Computer Networks · doi:10.1016/j.comnet.2020.107417 · Cited by 163
Lashkari, A. H., Kaur, G., & Rahali, A. (2020) · International Conference on Communication and Network Security (ICCNS) · doi:10.1145/3442520.3442521 · Cited by 181
“We define six-fold evaluation criteria based on [16, 23, 60] to compare publicly available encrypted or darknet traffic datasets used in the past as:”
MethodSelf-citationBoosting-Based DDoS Detection in Internet of Things Systems
Cvitić, I., Peraković, D., Gupta, B. B., & Choo, K. R. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3090909 · Cited by 160
Chiba, Z., Abghour, N., Moussaid, K., Omri, A. E., & Rida, M. (2019) · Computers & Security · doi:10.1016/j.cose.2019.06.013 · Cited by 160
Wang, Z., Fok, K. W., & Thing, V. L. L. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102542 · Cited by 185
“They tested the model using three different datasets, CICIDS-2017[54], UNSW0-NB15[22] and ISCX-bot-2014[72], which achieved 100%, 92.6% and 99.2% F1 scores, respectively.”
BackgroundInfluentialExplainable artificial intelligence for cybersecurity: a literature survey
Charmet, F., Tanuwidjaja, H. C., Ayoubi, S., Gimenez, P.-F., Han, Y., Jmila, H., Blanc, G., Takahashi, T., & Zhang, Z. (2022) · Annals of Telecommunications · doi:10.1007/s12243-022-00926-7 · Cited by 167
A Transfer Learning and Optimized CNN Based Intrusion Detection System for Internet of Vehicles
Yang, L., & Shami, A. A. (2022) · International Conference on Communications · doi:10.1109/icc45855.2022.9838780 · Cited by 179
“The effectiveness and efficiency of the proposed IDS framework are evaluated using two public vehicle network datasets: the Car-Hacking dataset [11] and the CICIDS2017 dataset [12].”
MethodInfluentialFog-Based Attack Detection Framework for Internet of Things Using Deep Learning
Samy, A., Yu, H., & Zhang, H. (2020) · IEEE Access · doi:10.1109/access.2020.2988854 · Cited by 164
“Fig.8 shows another comparison between LSTM and the KNN, RF, ID3 and quadratic discriminant analysis (QDA) for the CICIDS-2017 dataset used in [42].”
MethodFerrag, M. A., Shu, L., Friha, O., & Yang, X. K. (2021) · IEEE/CAA Journal of Automatica Sinica · doi:10.1109/jas.2021.1004344 · Cited by 166
Deep Learning in Intrusion Detection Systems
Karataş, G., Demir, Ö., & Şahingöz, Ö. K. (2018) · International Congress on Big Data, Deep Learning and Fighting Cyber Terrorism (IBIGDELFT) · doi:10.1109/ibigdelft.2018.8625278 · Cited by 161
“CIC has identified eleven criteria that are necessary for building a reliable benchmark dataset [11].”
BackgroundCICIoV2024: Advancing realistic IDS approaches against DoS and spoofing attack in IoV CAN bus
Neto, E. C. P., Taslimasa, H., Dadkhah, S., et al. (2024) · Internet of Things · doi:10.1016/j.iot.2024.101209 · Cited by 155
Self-citationFerrag, M. A., Friha, O., Kantarcı, B., Tihanyi, N., Cordeiro, L. C., Debbah, M. A., Hamouda, D., Al-Hawawreh, M. S., & Choo, K. R. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3317242 · Cited by 185
“• CICIDS2018 dataset [185]: generated by the Canadian Institute for cyber security [185] using the profiles notion containing comprehensive descriptions of attacks and detailed abstract distribution models for applications, protocols, or lower-level network entities.”
MethodÜstebay, S., Turgut, Z., & Aydın, M. A. (2018) · doi:10.1109/ibigdelft.2018.8625318 · Cited by 151
“The CICIDS2017 [10] dataset is used to test the proposed method.”
MethodAttack classification using feature selection techniques: a comparative study
Thakkar, A., & Lohiya, R. (2020) · Journal of Ambient Intelligence and Humanized Computing · doi:10.1007/s12652-020-02167-9 · Cited by 154
“– Considering the dataset being used and the attack categories, ML techniques produce high false alarm rate for wide range of attacks (Sharafaldin et al. 2018).”
BackgroundMethodInfluentialA, K. V., & Jacob, T. P. (2019) · International Conference on Communications and Signal Processing (ICCSP) · doi:10.1109/iccsp.2019.8698029 · Cited by 156
APT datasets and attack modeling for automated detection methods: A review
Stojanović, B., Hofer-Schmitz, K., & Kleb, U. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101734 · Cited by 147
Kumar, R., Kumar, P., Tripathi, R., Gupta, G. P., Kumar, N., & Hassan, M. M. (2022) · IEEE Transactions on Intelligent Transportation Systems · doi:10.1109/tits.2021.3098636 · Cited by 148
“• The proposed IDS is rigorously evaluated on two publicly available network datasets namely, ToN-IoT [24], [26] and CICIDS-2017 [25], [27] before and after applying the privacy technique.”
BackgroundMethodDuan, G., Lv, H., Wang, H., & Feng, G. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3228493 · Cited by 150
“Therefore, we choose 6 newly published public datasets with spatial information to evaluate the proposed DLGNN-based NIDS: NF-BoT-IoT [44], NF-ToN-IoT [44], NF-CSE-CIC-IDS2018 [44], NF-BoT-IoT-V2 [45], NF-ToN-IoT-V2 [45] and NF-CSE-CIC-IDS2018-V2 [45].”
MethodInfluentialRobust Network Intrusion Detection Through Explainable Artificial Intelligence (XAI)
Barnard, P., Marchetti, N., & DaSilva, L. A. (2022) · IEEE Networking Letters · doi:10.1109/lnet.2022.3186589 · Cited by 145
“…as the effectiveness of the ‘explanation domain’ in separating clusters of attacks from normal traffic, as well as to optimise the various stages our pipeline and to extend its ability to support multiclass classification across additional intrusion datasets, such as the more recent CIC-IDS2017 [18].”
BackgroundOverview on Intrusion Detection Systems for Computers Networking Security
Diana, L., Dini, P., & Paolini, D. (2025) · Computers · doi:10.3390/computers14030087 · Cited by 211
Fitni, Q. R. S., & Ramli, K. (2020) · IEEE International Conference on Industry 4.0, Artificial Intelligence, and Communications Technology (IAICT) · doi:10.1109/iaict50021.2020.9172014 · Cited by 151
“In addition, privacy and ethics are not concerns [4].”
BackgroundInfluentialAn Intrusion Detection System Against DDoS Attacks in IoT Networks
Roopak, M., Tian, G. Y., & Chambers, J. A. (2020) · IEEE Annual Computing and Communication Workshop and Conference (CCWC) · doi:10.1109/ccwc47524.2020.9031206 · Cited by 176
Ahmetoğlu, H., & Daş, R. (2022) · Internet of Things · doi:10.1016/j.iot.2022.100615 · Cited by 169
Sánchez, P. M. S., Valero, J. M. J., Celdrán, A. H., Bovet, G., Pérez, M. G., & Pérez, G. M. (2021) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3064259 · Cited by 156
“A set of relevant datasets, IDS 2017 and 2018 datasets [136], was created by the Canadian Institute of Cybersecurity (CIC).”
BackgroundMethodInfluentialRealguard: A Lightweight Network Intrusion Detection System for IoT Gateways
Nguyen, X.-H., Nguyen, X.-D., Huynh, H.-H., & Le, K.-H. (2022) · Sensors · doi:10.3390/s22020432 · Cited by 159
“This dataset published by the University of New Brunswick contains a sufficient amount of abnormal network traffic from common cyber attacks to train deep learning models [58].”
BackgroundA lightweight intrusion detection method for IoT based on deep learning and dynamic quantization
Wang, Z., Chen, H., Yang, S., Luo, X. Y., Li, D., & Wang, J. (2023) · PeerJ Computer Science · doi:10.7717/peerj-cs.1569 · Cited by 144
A Convolutional Neural Network for Improved Anomaly-Based Network Intrusion Detection
Al-Turaiki, I. M., & Altwaijry, Ν. (2021) · Big Data · doi:10.1089/big.2020.0263 · Cited by 159
“A number of other modern network intrusion detection data sets are publicly available now, such as CIC-IDS2017 48 and CIC-IDS2018.”
BackgroundAn End-to-End Framework for Machine Learning-Based Network Intrusion Detection System
Bertoli, G. D. C., Pereira, L. A., Saotome, O., dos Santos, A. L., Verri, F. A. N., Marcondes, C. A. C., Barbieri, S., Rodrigues, M. S., & de Oliveira, J. M. P. (2021) · IEEE Access · doi:10.1109/access.2021.3101188 · Cited by 156
Generative Deep Learning to Detect Cyberattacks for the IoT-23 Dataset
Abdalgawad, N. M., Sajun, A. R., Kaddoura, Y., Zualkernan, I. A., & Aloul, F. (2021) · IEEE Access · doi:10.1109/access.2021.3140015 · Cited by 160
“The experiment used 3 different intrusions datasets: NSL-KDD [21], UNSW-NB15 [23], CICIDS2017 with 5, 10 and 6 classes respectively [33].”
MethodAdversarial XAI Methods in Cybersecurity
Kuppa, A., & Le‐Khac, N. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3117075 · Cited by 151
A Two-Fold Machine Learning Approach to Prevent and Detect IoT Botnet Attacks
Hussain, F., Abbas, S. G., Pires, I. M., Tanveer, S., Fayyaz, U. U., García, N. M., Shah, G. A., & Shahzad, F. (2021) · IEEE Access · doi:10.1109/access.2021.3131014 · Cited by 141
“Likewise, we pre-processed DDoS and normal traffic of CICIDS-19 [55], CICIDS-17 [56] and Bot-IoT [38] dataset and labelled the resultant .csv files with respect to the description of these datasets.”
MethodInfluentialSDN‐based intrusion detection system for IoT using deep learning classifier (IDSIoT‐SDL)
Wani, A., Revathi, S., & Khaliq, R. (2021) · CAAI Transactions on Intelligence Technology · doi:10.1049/cit2.12003 · Cited by 147
“The CSE ‐ CIC ‐ IDS2018 is used as dataset for training in IDSIoT ‐ SDL [35].”
MethodIntrusion Detection System Based on Fast Hierarchical Deep Convolutional Neural Network
Mendonça, R. V., Teodoro, A. A. M., Rosa, R. L., Saadi, M., Carrillo, D., Nardelli, P. H. J., & Rodríguez, D. Z. (2021) · IEEE Access · doi:10.1109/access.2021.3074664 · Cited by 143
“For training and testing of the model, the CICIDS2017 dataset [21] was used.”
BackgroundMethodResultInfluentialDunmore, A., Jang‐Jaccard, J., Sabrina, F., & Kwak, J. (2023) · IEEE Access · doi:10.1109/access.2023.3296707 · Cited by 155
“The CSE-CIC-IDS2018 dataset [122] was used for the testing and training of the network.”
MethodIntelligent Cyber Attack Detection and Classification for Network-Based Intrusion Detection Systems
Oliveira, N. R. B. D., Praça, I., Maia, E., & Sousa, O. (2021) · Applied Sciences · doi:10.3390/app11041674 · Cited by 152
Machine-Learning-Enabled Intrusion Detection System for Cellular Connected UAV Networks
Shrestha, R., Omidkar, A., Roudi, S. A., Abbas, H., & Kim, S. (2021) · Electronics · doi:10.3390/electronics10131549 · Cited by 138
“A detail information on these attack scenarios can be found in [29].”
BackgroundMethodInfluentialTowards Model Generalization for Intrusion Detection: Unsupervised Machine Learning Techniques
Verkerken, M., D’hooge, L., Wauters, T., Volckaert, B., & Turck, F. D. (2021) · Journal of Network and Systems Management · doi:10.1007/s10922-021-09615-7 · Cited by 153
“The first dataset satisfying all 11 criteria is CIC-IDS-2017 and collects real network traffic using multiple internet protocols such as HTTP(s), FTP, SSH, IMAP, and POP3 for a duration of 5 days [34].”
MethodSalmi, S., & Oughdir, L. (2023) · Journal Of Big Data · doi:10.1186/s40537-023-00692-w · Cited by 153
“Kim et al. [4] proposed a model based on a Convolutional Neural Network (CNN) for detecting DoS attacks using the KDD-99 [5] dataset and the CICIDS2018 [6] dataset.”
MethodBand, S. S., Fathi, M., Chronopoulos, A. T., Montieri, A., Palumbo, F., & Pescapè, A. (2020) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2020.102582 · Cited by 136
Sarhan, M., Layeghy, S., & Portmann, M. (2022) · Big Data Research · doi:10.1016/j.bdr.2022.100359 · Cited by 157
“The CSE-CIC-IDS2018 dataset [10] have been converted into 43 NetFlow-based features using nProbe [25] to generate NF-CSE-CIC-IDS2018-v2.”
MethodIntrusion Detection System for IoT Based on Deep Learning and Modified Reptile Search Algorithm
Dahou, A., Elaziz, M. A., Chelloug, S. A., Awadallah, M. A., Al‐Betar, M. A., Al‐qaness, M. A. A., & Forestiero, A. (2022) · Computational Intelligence and Neuroscience · doi:10.1155/2022/6473507 · Cited by 149
“Te CICIDS-2017 [64] consists of 79 network fow features from gathered network trafc using the CICFlowMeter tool.”
MethodInfluentialA multimodal hybrid parallel network intrusion detection model
Shi, S., Han, D., & Cui, M. (2023) · Connection Science · doi:10.1080/09540091.2023.2227780 · Cited by 141
“The detailed experimental results of the CIC-IDS2017 dataset are presented in Tables 2–5.”
MethodInfluentialKumar, S. V. N. S., Selvi, M., & Kannan, A. (2023) · Computational Intelligence and Neuroscience · doi:10.1155/2023/8981988 · Cited by 138
Intrusion Detection System After Data Augmentation Schemes Based on the VAE and CVAE
Liu, C., Antypenko, R., Sushko, I., & Zakharchenko, O. (2022) · IEEE Transactions on Reliability · doi:10.1109/tr.2022.3164877 · Cited by 133
The Cross-Evaluation of Machine Learning-Based Network Intrusion Detection Systems
Apruzzese, G., Pajola, L., & Conti, M. (2022) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3157344 · Cited by 142
“• Heterogeneous scenario: here, we use the CTU13 [16], NB15 [60], IDS18 [15], DDOS19 [59].”
InfluentialA Lightweight IoT Intrusion Detection Model Based on Improved BERT-of-Theseus
Wang, Z., Li, J., Yang, S., Luo, X., Li, D., & Mahmoodi, S. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.122045 · Cited by 131
A Comprehensive Study of Anomaly Detection Schemes in IoT Networks Using Machine Learning Algorithms
Diro, A. A., Chilamkurti, N., Nguyen, V.-D., & Heyne, W. (2021) · Sensors · doi:10.3390/s21248320 · Cited by 132
A graph neural network method for distributed anomaly detection in IoT
Protogerou, A., Papadopoulos, S., Drosou, A., Tzovaras, D. K., & Refanidis, I. (2020) · Evolving Systems · doi:10.1007/s12530-020-09347-0 · Cited by 135
“This was the case in CICIDS 2017 (Sharafaldin et al. 2018), UNSWNB15 (Moustafa et al. 2018), ISCX-IDS-2012 (Shiravi et al. 2012), NSL-KDD (Tavallaee et al. 2009), ISCX (Beigi et al. 2014), ADFA (Creech 2014).”
MethodFederated TON_IoT Windows Datasets for Evaluating AI-Based Security Applications
Moustafa, N., Keshk, M., Debie, E., & Janicke, H. (2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00114 · Cited by 144
“devices communicate with each other to generate diverse normal patterns from conventional network systems [15], [16].”
BackgroundAn efficient feature selection based Bayesian and Rough set approach for intrusion detection
Prasad, M., Tripathi, S., & Dahal, K. P. (2019) · Applied Soft Computing · doi:10.1016/j.asoc.2019.105980 · Cited by 128
“We have measured 69 the quality realism of publicly available CICIDS2017 dataset using FLS 70 based on provided information [9].”
BackgroundMethodInfluentialA NSGA2-LR wrapper approach for feature selection in network intrusion detection
Khammassi, C., & Krichen, S. (2020) · Computer Networks · doi:10.1016/j.comnet.2020.107183 · Cited by 125
Zhang, Y., Chen, X., Guo, D., Song, M. N., Teng, Y., & Wang, X. (2019) · IEEE Access · doi:10.1109/access.2019.2933165 · Cited by 126
“To evaluate our model performance, we randomly selected 80% from the CICIDS2017 dataset as the training set and the remaining 20% as the test set.”
MethodInfluentialPacket-Level Signatures for Smart Home Devices
Trimananda, R., Varmarken, J., Markopoulou, A. P., et al. (2020) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2020.24097 · Cited by 126
“The third dataset is the Monday trace of the CICIDS2017 dataset [43].”
MethodTransfer Learning Approach to IDS on Cloud IoT Devices Using Optimized CNN
Okey, O. D., Carrillo, D., Saadi, M., Rosa, R. L., Kleinschmidt, J. H., & Rodríguez, D. Z. (2023) · IEEE Access · doi:10.1109/access.2022.3233775 · Cited by 133
“Nevertheless, to show that the model is competitive with previous proposals and presents a state of the art functionality, we compared the performance of the proposed model with that of an RNN-based IDS using LSTM [20], [22] and tree-based machine learning algorithms [23].”
BackgroundMethodA Study of Network Intrusion Detection Systems Using Artificial Intelligence/Machine Learning
Vanin, P., Newe, T., Dhirani, L. L., et al. (2022) · Applied Sciences · doi:10.3390/app122211752 · Cited by 124
Javeed, D., Saeed, M. S., Ahmad, I., Adil, M., Kumar, P., & Islam, A. K. M. N. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.06.023 · Cited by 143
“…Distributed Denial of service (DDoS), ransomware, password, scanning, Man in the middle (MITM) and cross-site scripting (XSS) CICIDS 2017 [110] Botnet (Ares), cross-site-scripting, DoS (executed through Hulk, GoldenEye, Slowloris, and Slowhttptest), DDoS (executed through LOIC),…”
BackgroundAdversarial machine learning for network intrusion detection: A comparative study
Jmila, H., & Khedher, M. I. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.109073 · Cited by 132
DeepAID: Interpreting and Improving Deep Learning-based Anomaly Detection in Security Applications
Han, D., Wang, Z., Chen, W., Zhong, Y., Wang, S., Zhang, H., Yang, J., Shi, X., & Yin, X. (2021) · Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3460120.3484589 · Cited by 121
“For fairness and simplicity, we select two well-labeled multi-class datasets, Kitsune dataset [35] and CIC-IDS2017 [43].”
InfluentialCarrión, R. M., Urda, D., Díaz-Cano, I., & Dorronsoro, B. (2020) · Applied Sciences · doi:10.3390/app10051775 · Cited by 132
“A realistic network dataset comprising up-to-date attack and normal traffic patterns from an emulated network environment is introduced by Sharafaldin et al. [17].”
Background
Metadata
- Authors
- Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A.
- Affiliations
- University of New Brunswick (CA)
- University of New Brunswick (UNB), Canada
- Venue
- Proceedings of the 4th International Conference on Information Systems Security and Privacy
- Published
- 2018
- Pages
- 108-116
- OpenAlex
- W2789828921
- Cited by
- 5,318
- References
- 27
- Citations by year
- 2026: 1170 · 2025: 1032 · 2024: 803 · 2023: 704 · 2022: 558 · 2021: 518 · 2020: 332 · 2019: 165 · 2018: 35
- FWCI
- 215.46
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- cc-by-nc-nd
- Locations
- International Conference on Information Systems Security and Privacy (ICISSP) (publishedVersion, cc-by-nc-nd)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- intrusion detection, intrusion detection datasets, network traffic characterization, network security, dataset construction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
