The DOI matches its Crossref record; 20 of the 27 references it cites were found in a registry or an index.
Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization
Open accessOverview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Many studies classify feature selection methods into three categories: filter-based techniques, wrapper techniques, and embed techniques”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [210]
Citations
Cites
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396 · cited 3×
“KDD’99 (University of California, Irvine 1998-99): This dataset is an updated version of the DARPA98, by processing the tcpdump portion.”
BackgroundMethodSelf-citationTesting Intrusion detection systems
McHugh, J. (2000) · ACM Transactions on Privacy and Security · doi:10.1145/382912.382923 · Cited by 1,490 · cited 4×
“Moreover, it lacks actual attack data records (McHugh, 2000) (Brown et al.”
BackgroundMethodInfluentialToward developing a systematic approach to generate benchmark datasets for intrusion detection
Shiravi, A., Shiravi, H., Tavallaee, M., & Ghorbani, A. A. (2012) · Computers & Security · doi:10.1016/j.cose.2011.12.012 · Cited by 1,345
Self-citationCharacterization of Tor Traffic using Time based Features
Lashkari, A. H., Gil, G. D., Mamun, M., & Ghorbani, A. A. (2017) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0006105602530262 · Cited by 926 · cited 3×
“We begin to extract the 80 traffic features from the dataset using CICFlowMeter (CICFlowMeter, 2017),(Habibi Lashkari et al., 2017).”
MethodSelf-citationStatistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation
Song, J., Takakura, H., Okabe, Y., Eto, M., Inoue, D., & Nakao, K. (2011) · International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security · doi:10.1145/1978672.1978676 · Cited by 335 · cited 2×
“The normal traffic here has been simulated repeatedly during the attacks and producing only DNS and mail traffic data, which is not reflected in real world normal network traffic, so there are no false positives, which are important for minimizing the number of alerts (Song et al., 2011) (M.”
BackgroundGeneration of a new IDS test dataset: Time to retire the KDD collection
Creech, G., & Hu, J.-K. (2013) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc.2013.6555301 · Cited by 326 · cited 1×
“ADFA (University of New South Wales 2013): This dataset includes normal training and validating data and 10 attacks per vector (Creech and Hu, 2013).”
MethodTowards a Reliable Intrusion Detection Benchmark Dataset
Sharafaldin, I., Gharib, A., Lashkari, A. H., & Ghorbani, A. A. (2017) · Software Networking · doi:10.13052/jsn2445-9739.2017.009 · Cited by 309 · cited 9×
“Finally, we evaluate the quality of the generated dataset by searching for common mistakes and criticisms of other synthetically created datasets, based on the 11 criteria from the last proposed dataset evaluation framework by Canadian Institute for Cybersecurity (CIC)(Sharafaldin et al., 2017).”
MethodInfluentialSelf-citationAn Evaluation Framework for Intrusion Detection Dataset
Gharib, A., Sharafaldin, I., Lashkari, A. H., et al. (2016) · International Conferences on Information Science and System · doi:10.1109/icissec.2016.7885840 · Cited by 224 · cited 6×
“Regarding to the last dataset evaluation framework published on 2016 (Gharib et al., 2016), covering eleven criteria is necessary for each dataset.”
BackgroundMethodInfluentialSelf-citationNetwork Intrusion Detection and Prevention - Concepts and Techniques
Ghorbani, A., Lu, W., & Tavallaee, M. (2009) · Advances in Information Security · doi:10.1007/978-0-387-88771-5 · Cited by 175 · cited 1×
“Since 1999, Scott et al. (Scott and Wilkins, 1999), Heideman and Papadopulus (Heidemann and Papdopoulos, 2009), Ghorbani et al. (Ghorbani Ali and Mahbod, 2010), Nehinbe (Nehinbe, 2011), Shiravi et al. (Ali Shiravi and Ghorbani, 2012), and Sharfaldin et al. (Gharib et al., 2016) tried to propose an…”
BackgroundSelf-citationA Labeled Data Set for Flow-Based Intrusion Detection
Sperotto, A., Sadre, R., van Vliet, F., & Pras, A. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04968-2_4 · Cited by 155 · cited 1×
“It is labelled and is more realistic, but the lack of volume and diversity of attacks is obvious (Sperotto et al., 2009).”
Background
Cited by
Sorted by citations
Items 401–500 of 1,010
Zhang, T., Xu, C., Lian, Y., Tian, H., Kang, J., Kuang, X., & Niyato, D. T. (2023) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2023.3310072 · Cited by 66
“In this section, we also evaluate the defense performance by using two event sequences generated by representative attack strategies and a real-world dataset called CICIDS-2017 [50].”
MethodNetDiffusion: Network Data Augmentation Through Protocol-Constrained Traffic Generation
Jiang, X., Liu, S., Gember-Jacobson, A., Bhagoji, A. N., Schmitt, P., Bronzino, F., & Feamster, N. (2024) · Proceedings of the ACM on Measurement and Analysis of Computing Systems · doi:10.1145/3639037 · Cited by 69
Survey of federated learning in intrusion detection
Zhang, H., Ye, J., Huang, W. X., Liu, X., & Gu, J. J. (2024) · Journal of Parallel and Distributed Computing · doi:10.1016/j.jpdc.2024.104976 · Cited by 74
Encrypted traffic classification based on Gaussian mixture models and Hidden Markov Models
Yao, Z., Ge, J., Wu, Y., Lin, X., He, R., & Ma, Y. (2020) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2020.102711 · Cited by 61
A Technique for Generating a Botnet Dataset for Anomalous Activity Detection in IoT Networks
Ullah, I., & Mahmoud, Q. H. (2020) · Conference proceedings/Conference proceedings - IEEE International Conference on Systems, Man, and Cybernetics · doi:10.1109/smc42975.2020.9283220 · Cited by 69
“The Canadian Institute of Cybersecurity has developed a new DDoS dataset [12] to remove weaknesses in the existing datasets [10],[13].”
BackgroundMethodShams, E. A., Rızaner, A., & Ulusoy, A. H. (2021) · Neural Computing and Applications · doi:10.1007/s00521-021-05994-9 · Cited by 62
“One of the more recent datasets is the Canadian Institute for Cybersecurity IDS 2017 (CICIDS2017) [6].”
BackgroundPanigrahi, R., Borah, S., Pramanik, M., et al. (2022) · Computer Communications · doi:10.1016/j.comcom.2022.03.009 · Cited by 62
Network Intrusion Detection via Flow-to-Image Conversion and Vision Transformer Classification
Ho, C. M. K., Yow, K., Zhu, Z., & Aravamuthan, S. (2022) · IEEE Access · doi:10.1109/access.2022.3200034 · Cited by 72
“299 Table 1 shows the important features which are extracted 300 from CIC IDS2017 [28] and Table 2 shows the important 301 features which are extracted from UNSW-NB15 [29].”
BackgroundEarly Detection of Network Intrusions Using a GAN-Based One-Class Classifier
Kim, T., & Pak, W. (2022) · IEEE Access · doi:10.1109/access.2022.3221400 · Cited by 72
Securing SDN: Hybrid autoencoder-random forest for intrusion detection and attack mitigation
Mhamdi, L., & Isa, M. M. (2024) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2024.103868 · Cited by 62
Ma, C., Du, X., & Cao, L. (2019) · IEEE Access · doi:10.1109/access.2019.2946708 · Cited by 62
Investigating Adversarial Attacks against Network Intrusion Detection Systems in SDNs
Aiken, J., & Scott-Hayward, S. (2019) · IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN) · doi:10.1109/nfv-sdn47374.2019.9040101 · Cited by 79
“Newer and more relevant datasets are surfacing, including the CICIDS dataset [23] generated in 2017, which contains various types of malicious and benign traffic.”
BackgroundGenerating Datasets for Anomaly-Based Intrusion Detection Systems in IoT and Industrial IoT Networks
Essop, I., Ribeiro, J., Παπαϊωάννου, Μ., Zachos, G., Μαντάς, Γ., & Rodrı́guez, J. (2021) · Sensors · doi:10.3390/s21041528 · Cited by 62
“In fact, although several datasets, such as KDDCUP99 [6], NSL-KDD [7], UNSW-NB15 [8], and CICD2017 [9] have been created over the past two decades for evaluation purposes of network-based intrusion detection systems (IDSs), they do not include any specific characteristics of IoT/IIoT networks as…”
BackgroundSystematic Literature Review of Security Event Correlation Methods
Kotenko, I. V., Gaifulina, D., & Zelichenok, I. (2022) · IEEE Access · doi:10.1109/access.2022.3168976 · Cited by 67
“Attack scenarios can also be explored in the CICIDS2017 dataset [183], which contains network traffic simulating the behaviour of 25 users.”
BackgroundZhou, H., Zheng, Y., Jia, X., & Shu, J. (2023) · Computer Networks · doi:10.1016/j.comnet.2023.109642 · Cited by 63
Alsaffar, A. M., Nouri-Baygi, M., & Zolbanin, H. M. (2024) · Journal Of Big Data · doi:10.1186/s40537-024-00994-7 · Cited by 62
QML-IDS: Quantum Machine Learning Intrusion Detection System
Abreu, D. M. D., Rothenberg, C. E., & Abelém, A. (2024) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc61673.2024.10733655 · Cited by 73
“To evaluate the proposed system, we conducted a comprehensive case study, leveraging three prominent network security databases: UNSW-NB15 [15], CICIDS17 [16], and CICIoT2023 [17].”
MethodEvaluation of Deep Learning in Detecting Unknown Network Attacks
Sabeel, U., Heydari, S. S., Harsh, M., Bendhaou, Y., Elgazzar, K., & El‐Khatib, K. (2019) · International Conference on Smart Applications, Communications and Networking (SmartNets) · doi:10.1109/smartnets48225.2019.9069788 · Cited by 68
“These files are captured after running benign traffic and DoS and DDoS attack traffic inspired by CICIDS2017 dataset [16].”
MethodA Deep Learning Approach Combining Autoencoder with One-class SVM for DDoS Attack Detection in SDNs
Mhamdi, L., McLernon, D., El-Moussa, F. A., et al. (2020) · IEEE International Conference on Communications and Networking (ComNet) · doi:10.1109/comnet47917.2020.9306073 · Cited by 60
“As mentioned in [17], most of the current network dataset is out-of-date and not reliable enough, so the CICIDS2017 dataset was proposed as a new benchmark dataset.”
BackgroundTowards a Universal Features Set for IoT Botnet Attacks Detection
Hussain, F. B., Abbas, S. G., Fayyaz, U. U., Shah, G. A., Toqeer, A., & Ali, A. (2020) · IEEE International Multitopic Conference (INMIC) · doi:10.1109/inmic50486.2020.9318106 · Cited by 63
“Recall - It is defined as the ability of the system to correctly detect the botnet attack upon the occurrence of the security TABLE II RESULTS OF DDOS ATTACK DETECTION ON CICIDS2017 [23] DATASET”
BackgroundMethodInfluentialMachine Learning for Detecting Anomalies and Intrusions in Communication Networks
Li, Z., Rios, A. L. G., & Trajković, L. (2021) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2021.3078497 · Cited by 61
“CIC has developed a testbed framework [77], [78] to gen-”
MethodAn Online Entropy-Based DDoS Flooding Attack Detection System With Dynamic Threshold
Tsobdjou, L. D., Pierre, S., & Quintero, A. (2022) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3142254 · Cited by 60
ITL-IDS: Incremental Transfer Learning for Intrusion Detection Systems
Mahdavi, E., Fanian, A., Mirzaei, A., et al. (2022) · Knowledge-Based Systems · doi:10.1016/j.knosys.2022.109542 · Cited by 61
Naiem, S., Khedr, A. E., Idrees, A. M., & Marie, M. I. (2023) · IEEE Access · doi:10.1109/access.2023.3328951 · Cited by 60
“These attacks are not equally distributed; the two highest attacks are DDOS, with 7.79% of the traffic, and DOS, with 4.03% [34], [35], [36].”
BackgroundInfluentialAli, Z., Tiberti, W., Marotta, A., et al. (2024) · IEEE Access · doi:10.1109/access.2024.3465045 · Cited by 60
Nascita, A., Aceto, G., Ciuonzo, D., Montieri, A., Persico, V., & Pescapè, A. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3504955 · Cited by 79
An Efficient Traffic Classification Scheme Using Embedded Feature Selection and LightGBM
Hua, Y. (2020) · Information Communication Technologies Conference (ICTC) · doi:10.1109/ictc49638.2020.9123302 · Cited by 64
MStream: Fast Anomaly Detection in Multi-Aspect Streams
Bhatia, S., Jain, A., Li, P., Kumar, R., & Hooi, B. (2021) · International World Wide Web Conference (WWW) · doi:10.1145/3442381.3450023 · Cited by 66
Empirical study on multiclass classification‐based network intrusion detection
Elmasry, W., Akbulut, A., & Zaim, A. H. (2019) · Computational Intelligence · doi:10.1111/coin.12220 · Cited by 65
“28 The environment infrastructure consists of two separate networks, which are attack-network and victim-network.”
BackgroundSDN-Defend: A Lightweight Online Attack Detection and Mitigation System for DDoS Attacks in SDN
Wang, J., & Wang, L. (2022) · Sensors · doi:10.3390/s22218287 · Cited by 72
“The CICIDS-2017 dataset [48] is one of the latest datasets available for intrusion detection.”
BackgroundResource Usage and Performance Trade-offs for Machine Learning Models in Smart Environments
Preuveneers, D., Tsingenopoulos, I., & Joosen, W. (2020) · Sensors · doi:10.3390/s20041176 · Cited by 60
“• CICIDS 2017: CICIDS 2017 [44] is a network intrusion detection dataset—available for download at https://www.”
BackgroundJeune, L. L., Goedemé, T., & Mentens, N. (2021) · IEEE Access · doi:10.1109/access.2021.3075066 · Cited by 62
“In [48], the authors list eleven characteristics that are essential for a valid intrusion detection dataset: attack diversity, anonymity, available protocols, complete capture, complete interaction, complete network configuration, complete traf-fic, feature set heterogeneity, labelling and metadata.”
BackgroundA survey on deep learning for challenged networks: Applications and trends
Bochie, K., Gilbert, M. S., Gantert, L., Barbosa, M. S. M., Medeiros, D. S. V., & Campista, M. E. M. (2021) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2021.103213 · Cited by 60
“Unlike the previous work, Sharafaldin et al. evaluate the performance of deep learning techniques compared with traditional machine learning models applied to anomaly detection (Sharafaldin et al., 2018).”
Otoum, S., Guizani, N., & Mouftah, H. T. (2022) · IEEE Transactions on Intelligent Transportation Systems · doi:10.1109/tits.2022.3159092 · Cited by 60
“For the proposed model evaluation, we adopted the Canadian Institute of Cybersecurity Intrusion Detection System (CICIDS2017) dataset that has ≈ three million samples with fifteen various classes [23].”
MethodMachine Learning for Network Intrusion Detection—A Comparative Study
Lail, M. A., García, A. J., & Olivo, S. (2023) · Future Internet · doi:10.3390/fi15070243 · Cited by 59
“The Canadian Institute of Cybersecurity’s data are used in this research to train ML models to detect different attacks, specifically the CICIDS-2017 dataset [15].”
IIsy: Hybrid In-Network Classification Using Programmable Switches
Zheng, C., Xiong, Z., Bui, T. T., Kaupmees, S., Bensoussane, R., Bernabeu, A., Vargaftik, S., Ben-Itzhak, Y., & Zilberman, N. (2024) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2024.3364757 · Cited by 107
“We report [47] similar quality of ML performance for medium-size models also with other attack-detection datasets [58], [59], [60] and other UNSW-based research [61].”
ResultBlack Box Attacks on Deep Anomaly Detectors
Kuppa, A., Grzonkowski, S., Asghar, M. R., & Le‐Khac, N. (2019) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3339252.3339266 · Cited by 64
“The IDS may use a learning system to discover anomalous traffic.”
BackgroundInfluentialA Long Short-Term Memory Enabled Framework for DDoS Detection
Liang, X., & Znati, T. F. (2019) · Globecom · doi:10.1109/globecom38437.2019.9013450 · Cited by 66
“The experimental evaluation framework uses a widely accepted benchmark datasets, CICIDS 2017 [25].”
MethodExplainable Security in SDN-Based IoT Networks
Sarica, A. K., & Angın, P. (2020) · Sensors · doi:10.3390/s20247326 · Cited by 62
“• CICIDS2017 [28] is another dataset that was created by the Canadian Institute of Cybersecurity.”
BackgroundTANTRA: Timing-Based Adversarial Network Traffic Reshaping Attack
Sharon, Y., Berend, D., Liu, Y., Shabtai, A., & Elovici, Y. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3201377 · Cited by 64
“We use the Kitsune dataset [23] and intrusion detection evaluation dataset CIC-IDS2017 [33].”
MethodR1DIT: Privacy-Preserving Malware Traffic Classification With Attention-Based Neural Networks
Barut, O., Luo, Y., Li, P., & Zhang, T. (2022) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3211254 · Cited by 56
“Our contributions in this article are threefold: (1) we propose a novel network flow classification technique leveraging protocol-specific raw header data by preserving users’ privacy with self-attention based neural network; (2) compare the accuracy and the inference speed of the proposed model to prior works employi…”
MethodResultVoting-based Ensemble Learning approach for Cyber Attacks Detection in Industrial Internet of Things
Golchha, R., Joshi, A., & Gupta, G. P. (2023) · Procedia Computer Science · doi:10.1016/j.procs.2023.01.153 · Cited by 57
Attack Detection for Medical Cyber-Physical Systems–A Systematic Literature Review
Weber, S. B., Stein, S., Pilgermann, M., & Schräder, T. (2023) · IEEE Access · doi:10.1109/access.2023.3270225 · Cited by 65
“In the 2018 dataset, they focused on insider attacks and provided system logs of every machine [149].”
BackgroundDDoS attacks and machine‐learning‐based detection methods: A survey and taxonomy
Najafimehr, M., Zarifzadeh, S., & Mostafavi, S. (2023) · Engineering Reports · doi:10.1002/eng2.12697 · Cited by 59
Quantum machine learning algorithms for anomaly detection: A review
Corli, S., Moro, L., Dragoni, D., Dispenza, M., & Prati, E. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.107632 · Cited by 81
An efficient feature reduction method for the detection of DoS attack
Kshirsagar, D. D., & Kumar, S. (2021) · ICT Express · doi:10.1016/j.icte.2020.12.006 · Cited by 57
Alimi, O. A., Ouahada, K., Abu-Mahfouz, A. M. I., Rimer, S., & Alimi, K. O. A. (2021) · Sustainability · doi:10.3390/su13179597 · Cited by 72
SSH and FTP brute-force Attacks Detection in Computer Networks: LSTM and Machine Learning Approaches
Hossain, M. D., Ochiai, H., Fall, D., & Kadobayashi, Y. (2020) · International Conference on Computer and Communication Systems (ICCCS) · doi:10.1109/icccs49078.2020.9118459 · Cited by 63
“CICIDS2017 [19] is a widely used dataset for attack detection.”
MethodChen, Y., Ashizawa, N., Yeo, C. K., Yanai, N., & Yean, S. (2021) · Knowledge-Based Systems · doi:10.1016/j.knosys.2021.107086 · Cited by 56
Using Embedded Feature Selection and CNN for Classification on CCD-INID-V1—A New IoT Dataset
Liu, Z., Thapa, N., Shaver, A., Roy, K., Siddula, M., Yuan, X., & Yu, A. (2021) · Sensors · doi:10.3390/s21144834 · Cited by 63
“[85] stressed the importance of attribute or feature selection for performing accurate network intrusion detection through manual feature selection.”
BackgroundThe robust deep learning–based schemes for intrusion detection in Internet of Things environments
Fu, X., Zhou, N., Jiao, L., Li, H., & Zhang, J. (2021) · Annals of Telecommunications · doi:10.1007/s12243-021-00854-y · Cited by 58
“We employ different deep neural network algorithms including GRU, LSTM, and CNN to study the effectiveness of adversarial attacks against these models on the CSE-CIC-IDS2018 dataset [10].”
MethodTushkanova, O. N., Levshun, D., Branitskiy, A. A., Владимировна, Ф. Е., Novikova, E. S., & Kotenko, I. V. (2023) · Algorithms · doi:10.3390/a16020085 · Cited by 61
Zhong, Y., Wang, Z., Shi, X., Yang, J., & Li, K. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3402439 · Cited by 60
Robust DDoS attack detection with adaptive transfer learning
Anley, M. B., Genovese, A., Agostinello, D., & Piuri, V. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103962 · Cited by 59
“Additionally, the pre-trained VGG19 model exhibited 100% accuracy in distinguishing benign from DDoS network traffic in the CSE-CIC-IDS2018 dataset.”
BackgroundMethodInfluentialExplainable AI and Random Forest based reliable intrusion detection system
Wali, S. W., Farrukh, Y. A., & Khan, I. (2025) · Computers & Security · doi:10.1016/j.cose.2025.104542 · Cited by 59
Prasad, M., Tripathi, S., & Dahal, K. P. (2020) · Computers & Security · doi:10.1016/j.cose.2020.102062 · Cited by 56
Polymorphic Adversarial DDoS attack on IDS using GAN
Chauhan, R., & Heydari, S. S. (2020) · International Symposium on Networks, Computers and Communications (ISNCC) · doi:10.1109/isncc49221.2020.9297264 · Cited by 55
Anomaly Detection in Encrypted Internet Traffic Using Hybrid Deep Learning
Bakhshi, T., & Ghita, B. (2021) · Security and Communication Networks · doi:10.1155/2021/5363750 · Cited by 65
“Different deep learning network structures are tested on three different datasets, the NSL-KDD, UNSW-NB15, and CIC-IDS-2017 offering a mix of network traffic to allow realistic evaluation of the proposed approach. combination of convolutional (CNN) and gated recurrent unit (GRU) neural models results in quick feature extra…”
InfluentialIntrusion Detection Using Payload Embeddings
Hassan, M., Haque, M. E., Tozal, M. E., Raghavan, V. V., & Agrawal, R. K. (2021) · IEEE Access · doi:10.1109/access.2021.3139835 · Cited by 56
“published the CICIDS-2017 [35] dataset.”
InfluentialLevshun, D., & Kotenko, I. V. (2023) · Artificial Intelligence Review · doi:10.1007/s10462-022-10381-4 · Cited by 67
Anomaly detection using ensemble techniques for boosting the security of intrusion detection system
Bukhari, O., Agarwal, P., Koundal, D., & Zafar, S. (2023) · Procedia Computer Science · doi:10.1016/j.procs.2023.01.080 · Cited by 59
Real-Time Malicious Traffic Detection With Online Isolation Forest Over SD-WAN
Zhang, P., He, F., Zhang, H., et al. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3262121 · Cited by 55
“We choose the flow-level statistics features described in [29] and [37], including the maximum, minimum and the mean of packet size.”
BackgroundMethodInfluentialExplainable Cross-domain Evaluation of ML-based Network Intrusion Detection Systems
Layeghy, S., & Portmann, M. (2023) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2023.108692 · Cited by 55
“This is also the case for CIC-2018, the fourth considered dataset, which has been generated by a different research group in a completely different network setup.”
MethodInfluentialDeep Learning Based Network Intrusion Detection System for Resource-Constrained Environments
Rizvi, S., Scanlon, M., McGibney, J., & Sheppard, J. (2023) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-36574-4_21 · Cited by 59
Network intrusion detection based on the temporal convolutional model
Lopes, I. O., Zou, D., Abdulqadder, I. H., Akbar, S., Li, Z., Ruambo, F. A., & Pereira, W. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103465 · Cited by 60
Security for the Metaverse: Blockchain and Machine Learning Techniques for Intrusion Detection
Truong, V. T., & Le, L. B. (2024) · IEEE Network · doi:10.1109/mnet.2024.3351882 · Cited by 55
“We evaluate the performance of MSecureChain on the CIC-IDS2017 dataset [14], which includes a record of nearly 3 million network flows, while each flow consists of more than 80 network traffic features.”
Deep Ensemble Learning With Pruning for DDoS Attack Detection in IoT Networks
Saiyedand, M. F., & Al‐Anbagi, I. (2024) · IEEE Transactions on Machine Learning in Communications and Networking · doi:10.1109/tmlcn.2024.3395419 · Cited by 55
“The DEEPShield system is validated using a self-generated dataset, named HL-IoT (covering both high-and low-volume attacks), and publicly available datasets, CICIDS2017 [51], ISCX2012 [52], and ToN-IoT [53].”
MethodAn intrusion detection method combining variational auto-encoder and generative adversarial networks
Li, Z., Huang, C., & Qiu, W. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110724 · Cited by 55
TON-IoT: Detection of Attacks on Internet of Things in Vehicular Networks
Sharma, A., Babbar, H., & Sharma, A. (2022) · 2022 6th International Conference on Electronics, Communication and Aerospace Technology · doi:10.1109/iceca55336.2022.10009070 · Cited by 55
An effect of chaos grasshopper optimization algorithm for protection of network infrastructure
Dwivedi, S., Vardhan, M., & Tripathi, S. (2020) · Computer Networks · doi:10.1016/j.comnet.2020.107251 · Cited by 53
Zhang, C., Costa‐Pérez, X., & Patras, P. (2020) · Cloud Computing Security Workshop · doi:10.1145/3411495.3421359 · Cited by 56
“We conduct all experiments (i.e., NID, black-box adversarial attacks, and attacks against NIDS augmented with the proposed defenses) using the publicly available CSE-CIC-IDS2018 dataset [42].”
BackgroundMethodAn Incremental Learning Method Based on Dynamic Ensemble RVM for Intrusion Detection
Wu, Z., Gao, P., Cui, L., & Chen, J. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3102388 · Cited by 55
TGA: A Novel Network Intrusion Detection Method Based on TCN, BiGRU and Attention Mechanism
Song, Y., Luktarhan, N., Shi, Z., & Wu, H. (2023) · Electronics · doi:10.3390/electronics12132849 · Cited by 58
FL-CTIF: A federated learning based CTI framework based on information fusion for secure IIoT
Salim, M. M., Azzaoui, A. E., Deng, X., & Park, J. H. (2023) · Information Fusion · doi:10.1016/j.inffus.2023.102074 · Cited by 56
A sequential deep learning framework for a robust and resilient network intrusion detection system
Hore, S., Ghadermazi, J., Shah, A., & Bastian, N. D. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103928 · Cited by 68
Huang, K., Xian, R., Xian, M., Wang, H., & Ni, L. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104067 · Cited by 59
Rabbani, M., Wang, Y., Khoshkangini, R., Jelodar, H., Zhao, R., Ahmadi, S. B. B., & Ayobi, S. (2021) · Entropy · doi:10.3390/e23050529 · Cited by 61
Efficient Network Intrusion Detection Using PCA-Based Dimensionality Reduction of Features
Abdulhammed, R., Faezipour, M., Musafer, H., et al. (2019) · International Symposium on Networks, Computers and Communications (ISNCC) · doi:10.1109/isncc.2019.8909140 · Cited by 53
“The time to build the model in [2] was 74.”
BackgroundMethodInfluentialTufan, E., Tezcan, C., & Acartürk, C. (2021) · IEEE Access · doi:10.1109/access.2021.3068961 · Cited by 53
Lei, S., Xia, C., Li, Z., et al. (2021) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2021.3109644 · Cited by 53
Network intrusion detection system: A survey on artificial intelligence‐based techniques
Habeeb, M. S., & Babu, T. R. (2022) · Expert Systems · doi:10.1111/exsy.13066 · Cited by 60
“The dataset contains the following attack types in the network Brute-force, DoS, DDoS, Web attacks, Heartbleed, Botnet, and infiltration (CSE-CIC-IDS2018, 2021; Lee et al., 2020; Sharafaldin et al., 2018).”
MethodGautam, S., Henry, A., Zuhair, M., Rashid, M. U., Javed, A. R., & Maddikunta, P. K. R. (2022) · Electronics · doi:10.3390/electronics11213529 · Cited by 53
Network intrusion detection based on n-gram frequency and time-aware transformer
Han, X., Cui, S., Liu, S., Zhang, C., Jiang, B., & Lü, Z. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103171 · Cited by 64
Effective network intrusion detection using stacking-based ensemble approach
Ali, M. S., Haque, M.-U., Durad, M. H., Usman, A., Mohsin, S. M., Mujlid, H. M., & Maple, C. R. (2023) · International Journal of Information Security · doi:10.1007/s10207-023-00718-7 · Cited by 64
Low-Quality Training Data Only? A Robust Framework for Detecting Encrypted Malicious Network Traffic
Qing, Y., Yin, Q., Deng, X., Chen, Y., Liu, Z., Sun, K., Xu, K., Zhang, J., & Li, Q. L. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.23081 · Cited by 66
“• CSE-CIC-IDS2018 (IDS) [59] is a widely-used intrusion detection dataset that records the network traffic generated by hundreds of hosts in an internal network and includes seven attack scenarios.”
BackgroundOn TinyML and Cybersecurity: Electric Vehicle Charging Infrastructure Use Case
Dehrouyeh, F., Yang, L., Ajaei, F. B., & Shami, A. A. (2024) · IEEE Access · doi:10.1109/access.2024.3437192 · Cited by 57
“This comprehensive dataset is particularly useful for cybersecurity research and has been crafted to include a diverse range of common cyber-attacks [111], [112].”
BackgroundEarly Network Intrusion Detection Enabled by Attention Mechanisms and RNNs
Djaidja, T. E. T., Brik, B., Senouci, S., Boualouache, A., & Ghamri-Doudane, Y. M. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3441862 · Cited by 59
“These datasets are CIC-IDS2017 [13] and 5G-NIDD [51].”
SafeML: Safety Monitoring of Machine Learning Classifiers Through Statistical Difference Measures
Aslansefat, K., Sorokos, I., Whiting, D., Kolagari, R. T., & Papadopoulos, Y. I. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-58920-2_13 · Cited by 54
“2 Security dataset This case-study applies the proposed method towards the CICIDS2017 dataset, which was originally produced by [30] at the Canadian Institute for Cyber Security (CICS) as an aide to the development and research of anomaly-based intrusion detection techniques for use in Intrusion Detection Systems (IDS…”
MethodA DDoS Attack Detection Method Based on Information Entropy and Deep Learning in SDN
Wang, L., & Liu, Y. (2020) · IEEE Information Technology, Networking, Electronic and Automation Control Conference (ITNEC) · doi:10.1109/itnec48623.2020.9085007 · Cited by 52
“Dataset CICIDS2017 [9] is chosen as the detection evaluation dataset.”
MethodSoftware-Defined Security-by-Contract for Blockchain-Enabled MUD-Aware Industrial IoT Edge Networks
Krishnan, P., Jain, K., Achuthan, K., & Buyya, R. (2021) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2021.3084341 · Cited by 53
“The datasets from Bot-IoT [23], CICIDS2017[24], and IoT traffic [25] are utilized to simulate the large-scale attacks.”
MethodNikoloudakis, Y., Kefaloukos, I., Klados, S., Panagiotakis, S., Pallis, E., Skianis, C. A., & Markakis, E. (2021) · Sensors · doi:10.3390/s21144939 · Cited by 52
“For the purposes of the evaluation of this research we created two (2) datasets, plain and enhanced, using the features comprised by the CIC-IDS2017 dataset [40] and the data captured from real-life network traffic, within our evaluation environment.”
MethodMaintainable Log Datasets for Evaluation of Intrusion Detection Systems
Landauer, M., Skopik, F., Frank, M., Hotwagner, W., Wurzenberger, M., & Rauber, A. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3201582 · Cited by 77
“Finally, after all labeling rules are processed, the resulting dataset consisting of the raw logs and their assigned labels is ready to be shared or used for IDS evaluation.”
BackgroundMethodMLTs-ADCNs: Machine Learning Techniques for Anomaly Detection in Communication Networks
Oleiwi, H. W., Mhawi, D. N., & Al-Raweshidy, H. S. (2022) · IEEE Access · doi:10.1109/access.2022.3201869 · Cited by 52
“Finally, CIC_IDS2017 contains benign data and latest widespread attacks [37] and the results of the CIC flow meter network traffic analysis.”
BackgroundA Multi-Stage Automated Online Network Data Stream Analytics Framework for IIoT Systems
Yang, L., & Shami, A. A. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3212003 · Cited by 52
“The proposed approach is evaluated on two public IIoT security datasets: IoTID20 [7] and CICIDS2017 [8].”
MethodInfluentialTier-Based Optimization for Synthesized Network Intrusion Detection System
Siddiqi, M. A., & Pak, W. (2022) · IEEE Access · doi:10.1109/access.2022.3213937 · Cited by 53
“The datasets used for the implementation of the proposed NIDS framework are CSE-CIC-IDS 2018 [23], CIC IDS 2017 [24], and ISCX IDS 2012 [25].”
MethodAutomatic Evasion of Machine Learning-Based Network Intrusion Detection Systems
Yan, H., Li, X., Zhang, W., Wang, R., Li, H., Zhao, X., Li, F., & Lin, X. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3247585 · Cited by 61
“Excellent ML-based IDSs have the basic competency requirement that performs well on typical attack traffic datasets (e.g., CIC-IDS2017 [20]).”
BackgroundEvaluating the impact of filter-based feature selection in intrusion detection systems
Zouhri, H., Idri, A., & Ratnani, A. (2023) · International Journal of Information Security · doi:10.1007/s10207-023-00767-y · Cited by 65
Abid, Y. A., Wu, J., Xu, G., Fu, S., & Waqas, M. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3376578 · Cited by 54
Explainable and Data-Efficient Deep Learning for Enhanced Attack Detection in IIoT Ecosystem
Attique, D., Wang, H., Wang, P., et al. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3384374 · Cited by 55
“1) Dataset and Preprocessing: In this work, we employed the CICIDS2017 [32] and X-IIoTID [33] datasets to evaluate the performance of the proposed IDS.”
An IoT Intrusion Detection Approach Based on Salp Swarm and Artificial Neural Network
Alzubi, O. A., Alzubi, J. A. A., Qiqieh, I., & Al-Zoubi, A. M. (2024) · International Journal of Network Management · doi:10.1002/nem.2296 · Cited by 57
“Several datasets have been proposed for IoT intrusion detection, including ISCX2012 [9], UNSWNB15 [7], and CICIDS2017 [8], which cover a wide range of attacks for study.”
Metadata
- Authors
- Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A.
- Affiliations
- University of New Brunswick (CA)
- University of New Brunswick (UNB), Canada
- Venue
- Proceedings of the 4th International Conference on Information Systems Security and Privacy
- Published
- 2018
- Pages
- 108-116
- OpenAlex
- W2789828921
- Cited by
- 5,318
- References
- 27
- Citations by year
- 2026: 1170 · 2025: 1032 · 2024: 803 · 2023: 704 · 2022: 558 · 2021: 518 · 2020: 332 · 2019: 165 · 2018: 35
- FWCI
- 215.46
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- cc-by-nc-nd
- Locations
- International Conference on Information Systems Security and Privacy (ICISSP) (publishedVersion, cc-by-nc-nd)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- intrusion detection, intrusion detection datasets, network traffic characterization, network security, dataset construction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
