The DOI matches its Crossref record; 20 of the 27 references it cites were found in a registry or an index.
Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization
Open accessOverview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Many studies classify feature selection methods into three categories: filter-based techniques, wrapper techniques, and embed techniques”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [210]
Citations
Cites
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396 · cited 3×
“KDD’99 (University of California, Irvine 1998-99): This dataset is an updated version of the DARPA98, by processing the tcpdump portion.”
BackgroundMethodSelf-citationTesting Intrusion detection systems
McHugh, J. (2000) · ACM Transactions on Privacy and Security · doi:10.1145/382912.382923 · Cited by 1,490 · cited 4×
“Moreover, it lacks actual attack data records (McHugh, 2000) (Brown et al.”
BackgroundMethodInfluentialToward developing a systematic approach to generate benchmark datasets for intrusion detection
Shiravi, A., Shiravi, H., Tavallaee, M., & Ghorbani, A. A. (2012) · Computers & Security · doi:10.1016/j.cose.2011.12.012 · Cited by 1,345
Self-citationCharacterization of Tor Traffic using Time based Features
Lashkari, A. H., Gil, G. D., Mamun, M., & Ghorbani, A. A. (2017) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0006105602530262 · Cited by 926 · cited 3×
“We begin to extract the 80 traffic features from the dataset using CICFlowMeter (CICFlowMeter, 2017),(Habibi Lashkari et al., 2017).”
MethodSelf-citationStatistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation
Song, J., Takakura, H., Okabe, Y., Eto, M., Inoue, D., & Nakao, K. (2011) · International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security · doi:10.1145/1978672.1978676 · Cited by 335 · cited 2×
“The normal traffic here has been simulated repeatedly during the attacks and producing only DNS and mail traffic data, which is not reflected in real world normal network traffic, so there are no false positives, which are important for minimizing the number of alerts (Song et al., 2011) (M.”
BackgroundGeneration of a new IDS test dataset: Time to retire the KDD collection
Creech, G., & Hu, J.-K. (2013) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc.2013.6555301 · Cited by 326 · cited 1×
“ADFA (University of New South Wales 2013): This dataset includes normal training and validating data and 10 attacks per vector (Creech and Hu, 2013).”
MethodTowards a Reliable Intrusion Detection Benchmark Dataset
Sharafaldin, I., Gharib, A., Lashkari, A. H., & Ghorbani, A. A. (2017) · Software Networking · doi:10.13052/jsn2445-9739.2017.009 · Cited by 309 · cited 9×
“Finally, we evaluate the quality of the generated dataset by searching for common mistakes and criticisms of other synthetically created datasets, based on the 11 criteria from the last proposed dataset evaluation framework by Canadian Institute for Cybersecurity (CIC)(Sharafaldin et al., 2017).”
MethodInfluentialSelf-citationAn Evaluation Framework for Intrusion Detection Dataset
Gharib, A., Sharafaldin, I., Lashkari, A. H., et al. (2016) · International Conferences on Information Science and System · doi:10.1109/icissec.2016.7885840 · Cited by 224 · cited 6×
“Regarding to the last dataset evaluation framework published on 2016 (Gharib et al., 2016), covering eleven criteria is necessary for each dataset.”
BackgroundMethodInfluentialSelf-citationNetwork Intrusion Detection and Prevention - Concepts and Techniques
Ghorbani, A., Lu, W., & Tavallaee, M. (2009) · Advances in Information Security · doi:10.1007/978-0-387-88771-5 · Cited by 175 · cited 1×
“Since 1999, Scott et al. (Scott and Wilkins, 1999), Heideman and Papadopulus (Heidemann and Papdopoulos, 2009), Ghorbani et al. (Ghorbani Ali and Mahbod, 2010), Nehinbe (Nehinbe, 2011), Shiravi et al. (Ali Shiravi and Ghorbani, 2012), and Sharfaldin et al. (Gharib et al., 2016) tried to propose an…”
BackgroundSelf-citationA Labeled Data Set for Flow-Based Intrusion Detection
Sperotto, A., Sadre, R., van Vliet, F., & Pras, A. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04968-2_4 · Cited by 155 · cited 1×
“It is labelled and is more realistic, but the lack of volume and diversity of attacks is obvious (Sperotto et al., 2009).”
Background
Cited by
Sorted by citations
Items 301–400 of 1,010
A Synthesized Dataset for Cybersecurity Study of IEC 61850 based Substation
Biswas, P. P., Tan, H. C., Zhu, Q., et al. (2019) · IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm) · doi:10.1109/smartgridcomm.2019.8909783 · Cited by 86
“Other popularly used datasets for evaluating network-based IDS include KDDCup99 [12], NSL-KDD [13], UNSW-NB15 [7], and CICIDS2017 [14].”
MethodSPEAR SIEM: A Security Information and Event Management system for the Smart Grid
Grammatikis, P. I. R., Sarigiannidis, P. G., Iturbe, E., Rios, E., Martinez, S., Sarigiannidis, A. G., Eftathopoulos, G., Spyridis, Y., Sesis, A., Vakakis, N., et al. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108008 · Cited by 96
Towards SDN-Enabled, Intelligent Intrusion Detection System for Internet of Things (IoT)
Muthanna, M. S. A., Alkanhel, R. I., Muthanna, A., Rafiq, A., & Abdullah, W. A. M. (2022) · IEEE Access · doi:10.1109/access.2022.3153716 · Cited by 86
“As a result, the proposed research work used the most up-to-date publicly available CICIDS2017 dataset [27].”
MethodDoS/DDoS-MQTT-IoT: A dataset for evaluating intrusions in IoT networks using the MQTT protocol
Alatram, A., Sikos, L. F., Johnstone, M., et al. (2023) · Computer Networks · doi:10.1016/j.comnet.2023.109809 · Cited by 86
Intrusion Detection System Using Machine Learning
Kiran, A., Prakash, S. W., Kumar, B. A., et al. (2023) · International Conference on Computer Communication and Informatics (ICCCI) · doi:10.1109/iccci56745.2023.10128363 · Cited by 86
Inter-dataset generalization strength of supervised machine learning methods for intrusion detection
D’hooge, L., Wauters, T., Volckaert, B., et al. (2020) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2020.102564 · Cited by 88
A Survey of Deep Learning Techniques for Cybersecurity in Mobile Networks
Rodríguez, E., Otero, B., Gutiérrez, N., & Canal, R. (2021) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3086296 · Cited by 95
“The CICIDS2017 dataset [122][123] contains attacks and normal network data, being very close to real network data.”
BackgroundMFFusion: A Multi-level Features Fusion Model for Malicious Traffic Detection based on Deep Learning
Lin, K., Xu, X., & Xiao, F. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108658 · Cited by 83
Concept Drift Adaptation Methods under the Deep Learning Framework: A Literature Review
Xiang, Q., Zi, L., Cong, X., & Wang, Y. (2023) · Applied Sciences · doi:10.3390/app13116515 · Cited by 89
“For example, the I-LSTM and ECNN algorithms are collected data, and CausalLSTM uses the HDFS dataset [107] and the Cybersecurity’s Intrusion Detection Evaluation dataset [108].”
MethodSwarm Intelligence inspired Intrusion Detection Systems — A systematic literature review
Nasir, M. H., Khan, S. A., Khan, M. M., & Fatima, M. (2022) · Computer Networks · doi:10.1016/j.comnet.2021.108708 · Cited by 84
A Hybrid Intrusion Detection System Based on Feature Selection and Weighted Stacking Classifier
Zhao, R., Mu, Y., Zou, L., & Wen, X. (2022) · IEEE Access · doi:10.1109/access.2022.3186975 · Cited by 86
An adaptable deep learning-based intrusion detection system to zero-day attacks
Soltani, M., Ousat, B., Siavoshani, M. J., & Jahangir, A. H. (2023) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2023.103516 · Cited by 87
“The evaluation of this framework has been done mainly over the CIC-IDS2017 dataset.”
BackgroundInfluentialDetecting DDoS attacks using adversarial neural network
Mustapha, A., Khatoun, R., Zeadally, S., Chbib, F., Fadlallah, A., Fahs, W., & Attar, A. E. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103117 · Cited by 101
Detecting web attacks using random undersampling and ensemble learners
Zuech, R., Hancock, J., & Khoshgoftaar, T. M. (2021) · Journal Of Big Data · doi:10.1186/s40537-021-00460-8 · Cited by 88
“To evaluate web attacks, we utilize the CSE-CIC-IDS2018 dataset which was created by Sharafaldin et al. [7] at the Canadian Institute for Cybersecurity.”
MethodMcCarthy, A., Ghadafi, E., Andriotis, P., & Legg, P. (2022) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp2010010 · Cited by 86
“[46] Mirai IoT 2017 Botnet [45] CICIDS2018 Traditional 2018 Bruteforce Web, DoS, DDoS, Botnet, Infiltration.”
BackgroundInfluentialDetecting Zero-Day Intrusion Attacks Using Semi-Supervised Machine Learning Approaches
Mbona, I., & Eloff, J. H. P. (2022) · IEEE Access · doi:10.1109/access.2022.3187116 · Cited by 85
Ntizikira, E., Wang, L., Alblehai, F., et al. (2023) · Sensors · doi:10.3390/s23198077 · Cited by 82
Model Evasion Attack on Intrusion Detection Systems using Adversarial Machine Learning
Ayub, M. A., Johnson, W. A., Talbert, D. A., & Siraj, A. (2020) · 2020 54th Annual Conference on Information Sciences and Systems (CISS) · doi:10.1109/ciss48834.2020.1570617116 · Cited by 86
“In our study, we first build a supervised machine learning model to detect and classify benign and attack traffic using two different network-based intrusion detection system (IDS) datasets: CICIDS 2017 [35] and TRAbID 2017 [43].”
MethodSecuring Wireless Sensor Networks Using Machine Learning and Blockchain: A Review
Ismail, S. S., Dawoud, D. W., & Reza, H. (2023) · Future Internet · doi:10.3390/fi15060200 · Cited by 91
“NRMSE is defined as a measure of a model’s predictive power against simple prediction using the mean of the observed data, and facilitates comparison between models with different scales; it is calculated as follows: NRMSE = RMSE A where A represents the mean of the observed data values, which can…”
MethodRoshan, K., Zafar, A., & Haque, S. B. U. (2023) · Computer Communications · doi:10.1016/j.comcom.2023.09.030 · Cited by 91
Machine Learning in Network Intrusion Detection: A Cross-Dataset Generalization Study
Cantone, M., Marrocco, C., & Bria, A. (2024) · IEEE Access · doi:10.1109/access.2024.3472907 · Cited by 151
“The datasets we utilize include CIC-IDS2017, CSE-CIC-IDS2018 [38], LycoS-IDS2017 [39], and LycoS-Unicas-IDS2018 generated for this research.”
BackgroundMethodArena, G., Chub, A., Lukianov, M., Strzelecki, R., Vinnikov, D., & Carne, G. D. (2024) · IEEE Open Journal of Power Electronics · doi:10.1109/ojpel.2024.3466936 · Cited by 88
“TinyML is used here against DoS and other common cyberat-tacks included in the CICIDS2017 dataset [221], [222].”
Programmable Switches for in-Networking Classification
Xavier, B. M., Guimarães, R. S., Comarela, G. V., et al. (2021) · doi:10.1109/infocom42981.2021.9488840 · Cited by 79
Launching Adversarial Attacks against Network Intrusion Detection Systems for IoT
Papadopoulos, P., von Essen, O. T., Pitropakis, N., Chrysoulas, C., Mylonas, A., & Buchanan, W. J. (2021) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp1020014 · Cited by 83
“The CSE-CIC-IDS [34] consists of seven attack categories: Brute-Force, Heartbleed, Botnet, DoS, Distributed Denial of Service (DDoS), Web Attacks and Insider Attacks.”
MethodSecuring a Smart Home with a Transformer-Based IoT Intrusion Detection System
Wang, M., Yang, N., & Weng, N. (2023) · Electronics · doi:10.3390/electronics12092100 · Cited by 79
IoV-BERT-IDS: Hybrid Network Intrusion Detection System in IoV Using Large Language Models
Fu, M., Wang, P., Liu, M., Zhang, Z., & Zhou, X. (2024) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2024.3402366 · Cited by 97
On High-Speed Flow-Based Intrusion Detection Using Snort-Compatible Signatures
Erlacher, F., & Dressler, F. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.2973992 · Cited by 78
“But there are a few problems arising with these traces [40].”
BackgroundCyber threat intelligence using PCA-DNN model to detect abnormal network behavior
Al-Fawa’reh, M., Al-Fayoumi, M. A., Nashwan, S. I., et al. (2021) · Egyptian Informatics Journal · doi:10.1016/j.eij.2021.12.001 · Cited by 78
ID-RDRL: a deep reinforcement learning-based feature selection intrusion detection model
Ren, K., Zeng, Y., Cao, Z., & Zhang, Y. (2022) · Scientific Reports · doi:10.1038/s41598-022-19366-3 · Cited by 92
“The CSE-CIC-IDS dataset family, proposed by the Canadian Cyber Security Laboratory 33 , has been extensively utilized in recent IDS research and is a family of intrusion detection datasets encompassing new forms of cyber threats.”
MethodLu, C., Wang, X., Yang, A., Liu, Y., & Dong, Z. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3283408 · Cited by 84
“1) We constructed a few-shot IoT intrusion detection data set FSIDS-IoT based on CIC-DDoS2019 [23], CIC-IDS2017, CSE-CIC-IDS2018 [24], NSL-KDD [25], and UNSW-NB15 [26].”
MethodA Few-Shot Class-Incremental Learning Method for Network Intrusion Detection
Du, L., Gu, Z., Wang, Y., Wang, L., & Jia, Y. (2023) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2023.3332284 · Cited by 83
“We used CIC-IDS2017 and CSE-CIC-IDS2018 as benchmark datasets [31], which are widely used in network intrusion detection research.”
MethodA novel hybrid feature selection and ensemble-based machine learning approach for botnet detection
Hossain, M. A., & Islam, M. S. (2023) · Scientific Reports · doi:10.1038/s41598-023-48230-1 · Cited by 93
“The CICIDS dataset 47,48 is a popular benchmark dataset used in the detection of botnets.”
BackgroundGhanem, W. A. H. M., Ghaleb, S. A. A., Jantan, A., et al. (2022) · IEEE Access · doi:10.1109/access.2022.3192472 · Cited by 77
CANET: A hierarchical CNN-Attention model for Network Intrusion Detection
Ren, K., Yuan, S., Zhang, C., Shi, Y., & Huang, Z. (2022) · Computer Communications · doi:10.1016/j.comcom.2023.04.018 · Cited by 88
Sharing Machine Learning Models as Indicators of Compromise for Cyber Threat Intelligence
Preuveneers, D., & Joosen, W. (2021) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp1010008 · Cited by 87
“As an alternative, we used the pre-processed log files produced by the CICFlowMeter tool, also provided in the same CSE-CIC-IDS2018 data set [51].”
MethodInfluentialNadeem, M., Ali, A., Riaz, S., et al. (2021) · IEEE Access · doi:10.1109/access.2021.3126535 · Cited by 76
A hybrid machine learning approach for detecting unprecedented DDoS attacks
Najafimehr, M., Zarifzadeh, S., & Mostafavi, S. (2022) · The Journal of Supercomputing · doi:10.1007/s11227-021-04253-x · Cited by 89
“[49] and provides DDoS and benign traffic flows.”
BackgroundRizvi, S., Scanlon, M., McGibney, J., & Sheppard, J. (2022) · IEEE Access · doi:10.1109/access.2022.3214506 · Cited by 87
“This dataset [39], provided by the Canadian Institute of Cybersecurity, comprises information recorded from Monday, July 3, 2017, until Friday, July 7, 2017, and is stored in eight files.”
MethodLCCDE: A Decision-Based Ensemble Framework for Intrusion Detection in The Internet of Vehicles
Yang, L., Shami, A. A., Stevens, G., et al. (2022) · Globecom · doi:10.1109/globecom48099.2022.10001280 · Cited by 76
“proposed technique with existing state-of-the-art methods [14] [16] [18] [19] [23] [24] on the two datasets.”
BackgroundMethodInfluentialFatani, A., Dahou, A., Elaziz, M. A., et al. (2023) · Sensors · doi:10.3390/s23094430 · Cited by 76
“The datasets used to train and test the proposed framework are KDDCup-99, NSL-KDD, BoT-IoT, and CICIDS-2017.”
MethodDeep Learning Techniques for Cyber Security Intrusion Detection : A Detailed Analysis
Ferrag, M. A., Maglaras, L. A., Janicke, H., & Smith, R. (2019) · Electronic workshops in computing · doi:10.14236/ewic/icscsr19.16 · Cited by 74
“In order to test the efficiceny of such mechanisms, reliable datasets that contain both bening and several attacks, meets real world criteria and that is publicly avaialble is needed Sharafaldin et al. (2018).”
BackgroundInfluentialCognitive Memory-Guided AutoEncoder for Effective Intrusion Detection in Internet of Things
Lu, H., Wang, T., Xu, X., & Wang, T. (2021) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2021.3102637 · Cited by 74
Okey, O. D., Maidin, S. S., Adasme, P., Rosa, R., Saadi, M., Carrillo, D., & Rodríguez, D. Z. (2022) · Sensors · doi:10.3390/s22197409 · Cited by 80
Online Self-Supervised Deep Learning for Intrusion Detection Systems
Nakıp, M., & Erol Gelenbe, A. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3402148 · Cited by 93
“Some other examples of such datasets are UNSW-NB15 [64], CICIDS 2017 [65], and IoT-23 [34].”
BackgroundMUD-based behavioral profiling security framework for software-defined IoT networks
Krishnan, P., Jain, K., Buyya, R., Vijayakumar, P., Nayyar, A., Bilal, M., & Song, H. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3113577 · Cited by 71
“In BotIoT [26] (5 attack classes, 8000 malign, and 60 000 benign) and CICIDS [25] (8 types of attacks, 5000 malign samples, and 60 000 benign).”
BackgroundMethodInfluentialJi, I. H., Lee, J. H., Kang, M. J., Park, W. J., Jeon, S. H., & Seo, J. T. (2024) · Sensors · doi:10.3390/s24030898 · Cited by 74
“The dataset includes encrypted and unencrypted traffic, including HTTP, HTTPS, FTP, and SSH [62].”
MethodHanafi, A. V., Ghaffari, A., Rezaei, H., Valipour, A., & Arasteh, B. (2023) · Cluster Computing · doi:10.1007/s10586-023-04102-x · Cited by 76
“In this paper, two IDSs datasets (CICIDS2017 [38] and NSL-KDD [39]) have been used to train and test the proposed model.”
A Network Intrusion Detection Model Based on BiLSTM with Multi-Head Attention Mechanism
Zhang, J., Zhang, X., Liu, Z., Fu, F., Jiao, Y., & Xu, F. (2023) · Electronics · doi:10.3390/electronics12194170 · Cited by 92
A Holistic Review of Machine Learning Adversarial Attacks in IoT Networks
Khazane, H., Ridouani, M., Salahdine, F., & Kaabouch, N. (2024) · Future Internet · doi:10.3390/fi16010032 · Cited by 89
Federated Quantum-Based Privacy-Preserving Threat Detection Model for Consumer Internet of Things
Namakshenas, D., Yazdinejad, A., Dehghantanha, A., & Srivastava, G. (2024) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2024.3377550 · Cited by 75
Enhancing network intrusion detection performance using generative adversarial networks
Zhao, X., Fok, K. W., & Thing, V. L. L. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104005 · Cited by 81
An Intrusion Detection System Based on Deep Belief Networks
Belarbi, O., Khan, A., Carnelli, P., et al. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-17551-0_25 · Cited by 79
“Each record in the dataset has 78 network features extracted with a network traffic analyser, CICFlowMeter [26].”
InfluentialBlockchain-Based Authentication and Explainable AI for Securing Consumer IoT Applications
Kumar, R., Javeed, D., Aljuhani, A., et al. (2024) · IEEE transactions on consumer electronics · doi:10.1109/tce.2023.3320157 · Cited by 64
“For the dataset and evaluation metrics, we utilized the CICIDS2017 dataset, which is IoT-based, as referenced in [35].”
MethodAn Encoding Technique for CNN-based Network Anomaly Detection
Kim, T., Suh, S. C., Kim, H., Kim, J., & Kim, J. (2018) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata.2018.8622568 · Cited by 76
“c) IDS2017 dataset [11]: This dataset provides the”
BackgroundMethodTowards Evaluation of NIDSs in Adversarial Setting
Hashemi, M., Cusack, G., & Keller, E. R. (2019) · doi:10.1145/3359992.3366642 · Cited by 81
“The CICIDS2017 [22] dataset contains flows extracted from packets files using the CICFlowMeter Tool [11].”
BackgroundMethodInfluentialA Deep Hierarchical Network for Packet-Level Malicious Traffic Detection
Wang, B., Su, Y., Zhang, M., & Nie, J. (2020) · IEEE Access · doi:10.1109/access.2020.3035967 · Cited by 73
“We use ISCX2012 [28], USTC-TFC2016 [10] and CICIDS2017 [29] as experimental data sets for the reason that with the continuous development of the Internet, the old KDD CUP 99 and DARPA 1998 can no longer reflect the real situation of today’s network traffic.”
MethodPWPAE: An Ensemble Framework for Concept Drift Adaptation in IoT Data Streams
Yang, L., Manias, D. M., & Shami, A. A. (2021) · Globecom · doi:10.1109/globecom46510.2021.9685338 · Cited by 72
“For the average online prediction time for each instance shown in Table I, although the proposed PWPAE method requires higher time (8.3 ms and 6.4 ms on the IoTID20 and CICIDS2017 datasets, respectively) than certain other compared methods, the average execution time is still at a low level (less than 10 ms).”
BackgroundMethodInfluentialAE-CGAN Model based High Performance Network Intrusion Detection System
Lee, J., & Park, K. (2019) · Applied Sciences · doi:10.3390/app9204221 · Cited by 71
“AE can be used as a feature extraction method and can be employed to directly detect intrusions.”
MethodAnomaly-based Intrusion Detection Approach for IoT Networks Using Machine Learning
Maniriho, P., Niyigaba, E., Bizimana, Z., et al. (2020) · International Conference on Computer Engineering, Network, and Intelligent Multimedia (CENIM) · doi:10.1109/cenim51130.2020.9297958 · Cited by 71
FS-IDS: A framework for intrusion detection based on few-shot learning
Yang, J., Li, H., Shao, S., et al. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102899 · Cited by 71
Towards asynchronous federated learning based threat detection: A DC-Adam approach
Pu, T., Chen, Z., Yu, W., & Liao, W. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102344 · Cited by 68
Network Intrusion Detection Based on Extended RBF Neural Network With Offline Reinforcement Learning
López‐Martín, M., Sánchez-Esguevillas, A., Arribas, J. I., & Carro, B. (2021) · IEEE Access · doi:10.1109/access.2021.3127689 · Cited by 71
DI-NIDS: Domain invariant network intrusion detection system
Layeghy, S., Baktashmotlagh, M., & Portmann, M. (2023) · Knowledge-Based Systems · doi:10.1016/j.knosys.2023.110626 · Cited by 85
“The authors use three versions of the CIC-IDS [12] dataset for the evaluation of their proposed algorithm.”
MethodInfluentialThakkar, A., & Lohiya, R. (2023) · Archives of Computational Methods in Engineering · doi:10.1007/s11831-023-09943-8 · Cited by 73
“The categories of features used for learning the attack pattern include time-series features, packet header features, packet payload features, and statistical features [103].”
BackgroundMethodInfluentialFeature Analysis for Machine Learning-based IoT Intrusion DetectionPreprint
Sarhan, M., Layeghy, S., & Portmann, M. (2022) · Research Square · doi:10.21203/rs.3.rs-2035633/v1 · Cited by 73
Online DDoS attack detection using Mahalanobis distance and Kernel-based learning algorithm
Çakmakçı, S. D., Kemmerich, T., Ahmed, T., et al. (2020) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2020.102756 · Cited by 69
Towards Effective Network Intrusion Detection: From Concept to Creation on Azure Cloud
Rajagopal, S., Kundapur, P. P., & Hareesha, K. S. (2021) · IEEE Access · doi:10.1109/access.2021.3054688 · Cited by 69
“CICIDS 2017 dataset [56] is comparatively a newer offering that was created using benign-profile system for recording the abstract behavior of users.”
BackgroundMethodInfluentialApplications of Machine Learning in Networking: A Survey of Current Issues and Future Challenges
Ridwan, M. A., Radzi, N. A. M., Abdullah, F., & Jalil, Y. E. (2021) · IEEE Access · doi:10.1109/access.2021.3069210 · Cited by 76
Duy, P. T., Tien, L. K., Khoa, N. H., Hien, D. T. T., Nguyen, A. G.-T., & Pham, V.-H. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102367 · Cited by 70
A Survey of Intrusion Detection Using Deep Learning in Internet of Things
Farhan, B. I., & Jasim, A. D. (2021) · Iraqi Journal for Computer Science and Mathematics · doi:10.52866/ijcsm.2022.01.01.009 · Cited by 69
Novel Class Probability Features for Optimizing Network Attack Detection With Machine Learning
Raza, A., Munir, K., Almutairi, M. S., et al. (2023) · IEEE Access · doi:10.1109/access.2023.3313596 · Cited by 69
“The experimental findings, which use the CICIDS2017 dataset, demonstrate a high accuracy rate.”
MethodInfluentialMachine-Learning Techniques for Detecting Attacks in SDN
Elsayed, M. S., Le-Khac, N.-A., Dev, S., & Jurcut, A. D. (2019) · 2019 IEEE 7th International Conference on Computer Science and Network Technology (ICCSNT) · doi:10.1109/iccsnt47585.2019.8962519 · Cited by 72
“There are several datasets such as KDDCUP’99 [17], CICIDS2017 [18], ISCX2012 [19], Kyoto [20], LBNL [21], UMASS [22], CDX [23], ADFA [24], DEFCON [25] have been used for intrusion detection systems.”
MethodEffects of feature selection and normalization on network intrusion detection
Umar, M. A., Chen, Z., Shuaib, K., & Liu, Y. (2024) · Data Science and Management · doi:10.1016/j.dsm.2024.08.001 · Cited by 100
Shoukat, S., Gao, T., Javeed, D., Saeed, M. S., & Adil, M. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104191 · Cited by 69
On the Improvement of the Isolation Forest Algorithm for Outlier Detection with Streaming Data
Heigl, M., Anand, K., Urmann, A., Fiala, D., Schramm, M., & Hable, R. (2021) · Electronics · doi:10.3390/electronics10131534 · Cited by 72
“html, accessed 12 May 2021), have been criticized by many researchers since their data are out of date or do not represent the threat landscape of today [53,54].”
BackgroundWang, Z., & Thing, V. L. L. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103143 · Cited by 64
“CICIDS2017 [23]; CICIDS-2012 [24]; CIRA-CIC-DoHBRW-2020 [25] are three datasets published by the Canadian Institute for Cybersecurity (CIC).”
Comparison of ML/DL Approaches for Detecting DDoS Attacks in SDN
Ali, T. E., Chong, Y.-W., & Manickam, S. (2023) · Applied Sciences · doi:10.3390/app13053033 · Cited by 67
Machine learning-based intrusion detection: feature selection versus feature extraction
Ngo, V.-D., Vuong, T.-C., Luong, T. V., & Tran, H. (2023) · Cluster Computing · doi:10.1007/s10586-023-04089-5 · Cited by 68
“In the future, we intend to explore whether our observations with UNSW-NB15 are applicable to other intrusion detection datasets, such as, NSL-KDD, KDD99, CICIDS2017, and DARPA1998.”
Adversarial Examples Detection for XSS Attacks Based on Generative Adversarial Networks
Zhang, X., Zhou, Y., Pei, S., Zhuge, J., & Chen, J. (2020) · IEEE Access · doi:10.1109/access.2020.2965184 · Cited by 69
“To include the new type of XSS attack, an intrusion detection evaluation dataset called CICIDS2017 [16] is used.”
MethodAyodeji, A., Liu, Y.-K., Chao, N., & Yang, L.-Q. (2020) · Nuclear Engineering and Technology · doi:10.1016/j.net.2020.05.012 · Cited by 66
Jin, F., Chen, M., Zhang, W., Yuan, Y., & Wang, S. (2021) · Information Sciences · doi:10.1016/j.ins.2021.08.010 · Cited by 67
Korba, A. A., Boualouache, A., & Ghamri-Doudane, Y. M. (2024) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2024.3385916 · Cited by 66
“We conducted a comparative analysis with their work using the CIC-IDS-2017 dataset [36].”
MethodTran, D.-H., & Park, M. (2024) · Applied Sciences · doi:10.3390/app14166932 · Cited by 68
“CIC-IDS2017 [35] is an intrusion detection evaluation dataset created in 2017 by the University of Brunswick (UNB) and the Canadian Institute of Cybersecurity (CIC).”
MethodAlwaisi, Z., Kumar, T., Harjula, E., et al. (2024) · Internet of Things · doi:10.1016/j.iot.2024.101398 · Cited by 66
Rahmati, M., & Pagano, A. (2025) · Informatics · doi:10.3390/informatics12030062 · Cited by 73
“The dataset has been extensively described in the paper [20], which provides more details about the dataset and its fundamental principles.”
Chadza, T., Kyriakopoulos, K. G., & Lambotharan, S. (2020) · Future Generation Computer Systems · doi:10.1016/j.future.2020.03.014 · Cited by 65
Towards Network Anomaly Detection Using Graph Embedding
Xiao, Q., Liu, J., Wang, Q., et al. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-50423-6_12 · Cited by 65
“In this experiment, we used the CICIDS 2017 [15] dataset.”
BackgroundMethodInfluentialDeep Learning in Diverse Intelligent Sensor Based Systems
Zhu, Y., Wang, M., Yin, X., Zhang, J., Meijering, E. H. W., & Hu, J. (2022) · Sensors · doi:10.3390/s23010062 · Cited by 73
Intrusion Detection Based on Federated Learning: A Systematic Review
Hernández-Ramos, J. L., Καρόπουλος, Γ., Chatzoglou, E., Kouliaridis, V., Campos, E. M., González-Vidal, A., & Kambourakis, G. (2025) · ACM Computing Surveys · doi:10.1145/3731596 · Cited by 117
A Two-Level Hybrid Model for Anomalous Activity Detection in IoT Networks
Ullah, I., & Mahmoud, Q. H. (2019) · IEEE Consumer Communications & Networking Conference (CCNC) · doi:10.1109/ccnc.2019.8651782 · Cited by 64
“To address these challenges the UNSW-NB15 [23, 24] and CICIDS2017 [25, 26] datasets have been recently released at defense force academy University of New South Wales Australia and Canadian Institute for Cybersecurity (CIC), University of New Brunswick Canada respectively.”
MethodAn Intrusion Detection System for Multi-class Classification Based on Deep Neural Networks
Toupas, P., Chamou, D., Giannoutakis, K. M., et al. (2019) · IEEE International Conference on Machine Learning and Applications (ICMLA) · doi:10.1109/icmla.2019.00206 · Cited by 64
“Index Terms—Cybersecurity, Intrusion Detection System, Deep Neural Networks, CICIDS2017, Flow Feature-Based, Multi-Class Classification I. INTRODUCTION During the past few years, the rising exposure of many organisations to sophisticated cyber-attacks have led to a rapid development of innovative IDSs.”
BackgroundMethodInfluentialAchieving Explainability of Intrusion Detection System by Hybrid Oracle-Explainer Approach
Szczepański, M., Choraś, M., Pawlicki, M., & Kozik, R. (2020) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn48605.2020.9207199 · Cited by 67
Detecting cybersecurity attacks across different network features and learners
Leevy, J. L., Hancock, J. M., Zuech, R., et al. (2021) · Journal Of Big Data · doi:10.1186/s40537-021-00426-w · Cited by 64
“Introduction CSE-CIC-IDS2018 [1], also referred to as the 2018 dataset throughout this text, is an intrusion detection dataset with normal and anomalous instances of network traffic.”
BackgroundAdaptive Clustering-based Malicious Traffic Classification at the Network Edge
Diallo, A. F., & Patras, P. (2021) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom42981.2021.9488690 · Cited by 74
“For comparison purposes, we evaluate all the benchmarks considered on a random subset of the ISCX-IDS 2012 dataset, which was released by the University of New Brunswick and consists of seven days of raw network data, including benign and four types of malicious network traffic, namely BruteForce SSH, DDoS, HttpDoS, a…”
MethodFGMD: A robust detector against adversarial attacks in the IoT network
Jiang, H., Lin, J., & Kang, H. (2022) · Future Generation Computer Systems · doi:10.1016/j.future.2022.02.019 · Cited by 64
Hassan, I. H., Abdullahi, M., Aliyu, M. M., et al. (2022) · Intelligent Systems with Applications · doi:10.1016/j.iswa.2022.200114 · Cited by 64
Machine Learning Algorithms for Network Intrusion Detection
Li, J., Qu, Y., Chao, F., et al. (2018) · Intelligent systems reference library · doi:10.1007/978-3-319-98842-9_6 · Cited by 65
“Thereby, future research may consider using alternate datasets, such as those reported in [14, 63].”
MethodARIES: A Novel Multivariate Intrusion Detection System for Smart Grid
Grammatikis, P. I. R., Sarigiannidis, P. G., Efstathopoulos, G., & Panaousis, E. (2020) · Sensors · doi:10.3390/s20185305 · Cited by 65
“The anomalous records originated again from CSE-CIC-IDS2018 [52], by changing the corresponding cyberattack label to “Anomaly”.”
BackgroundMethodInfluentialNetwork Anomaly Detection With Temporal Convolutional Network and U-Net Model
Mezina, A., Bürget, R., & Travieso, C. M. (2021) · IEEE Access · doi:10.1109/access.2021.3121998 · Cited by 67
“One of the modern datasets is CIC-IDS2017 [3], which was developed by the Canadian Institute of Cyber Security.”
BackgroundMethodInfluentialFlowrest: Practical Flow-Level Inference in Programmable Switches with Random Forests
Akem, A. T., Gucciardo, M., & Fiore, M. (2023) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom53939.2023.10229100 · Cited by 63
Metadata
- Authors
- Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A.
- Affiliations
- University of New Brunswick (CA)
- University of New Brunswick (UNB), Canada
- Venue
- Proceedings of the 4th International Conference on Information Systems Security and Privacy
- Published
- 2018
- Pages
- 108-116
- OpenAlex
- W2789828921
- Cited by
- 5,318
- References
- 27
- Citations by year
- 2026: 1170 · 2025: 1032 · 2024: 803 · 2023: 704 · 2022: 558 · 2021: 518 · 2020: 332 · 2019: 165 · 2018: 35
- FWCI
- 215.46
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- cc-by-nc-nd
- Locations
- International Conference on Information Systems Security and Privacy (ICISSP) (publishedVersion, cc-by-nc-nd)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- intrusion detection, intrusion detection datasets, network traffic characterization, network security, dataset construction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
