The DOI matches its Crossref record; 20 of the 27 references it cites were found in a registry or an index.
Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization
Open accessOverview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Many studies classify feature selection methods into three categories: filter-based techniques, wrapper techniques, and embed techniques”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [210]
Citations
Cites
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396 · cited 3×
“KDD’99 (University of California, Irvine 1998-99): This dataset is an updated version of the DARPA98, by processing the tcpdump portion.”
BackgroundMethodSelf-citationTesting Intrusion detection systems
McHugh, J. (2000) · ACM Transactions on Privacy and Security · doi:10.1145/382912.382923 · Cited by 1,490 · cited 4×
“Moreover, it lacks actual attack data records (McHugh, 2000) (Brown et al.”
BackgroundMethodInfluentialToward developing a systematic approach to generate benchmark datasets for intrusion detection
Shiravi, A., Shiravi, H., Tavallaee, M., & Ghorbani, A. A. (2012) · Computers & Security · doi:10.1016/j.cose.2011.12.012 · Cited by 1,345
Self-citationCharacterization of Tor Traffic using Time based Features
Lashkari, A. H., Gil, G. D., Mamun, M., & Ghorbani, A. A. (2017) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0006105602530262 · Cited by 926 · cited 3×
“We begin to extract the 80 traffic features from the dataset using CICFlowMeter (CICFlowMeter, 2017),(Habibi Lashkari et al., 2017).”
MethodSelf-citationStatistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation
Song, J., Takakura, H., Okabe, Y., Eto, M., Inoue, D., & Nakao, K. (2011) · International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security · doi:10.1145/1978672.1978676 · Cited by 335 · cited 2×
“The normal traffic here has been simulated repeatedly during the attacks and producing only DNS and mail traffic data, which is not reflected in real world normal network traffic, so there are no false positives, which are important for minimizing the number of alerts (Song et al., 2011) (M.”
BackgroundGeneration of a new IDS test dataset: Time to retire the KDD collection
Creech, G., & Hu, J.-K. (2013) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc.2013.6555301 · Cited by 326 · cited 1×
“ADFA (University of New South Wales 2013): This dataset includes normal training and validating data and 10 attacks per vector (Creech and Hu, 2013).”
MethodTowards a Reliable Intrusion Detection Benchmark Dataset
Sharafaldin, I., Gharib, A., Lashkari, A. H., & Ghorbani, A. A. (2017) · Software Networking · doi:10.13052/jsn2445-9739.2017.009 · Cited by 309 · cited 9×
“Finally, we evaluate the quality of the generated dataset by searching for common mistakes and criticisms of other synthetically created datasets, based on the 11 criteria from the last proposed dataset evaluation framework by Canadian Institute for Cybersecurity (CIC)(Sharafaldin et al., 2017).”
MethodInfluentialSelf-citationAn Evaluation Framework for Intrusion Detection Dataset
Gharib, A., Sharafaldin, I., Lashkari, A. H., et al. (2016) · International Conferences on Information Science and System · doi:10.1109/icissec.2016.7885840 · Cited by 224 · cited 6×
“Regarding to the last dataset evaluation framework published on 2016 (Gharib et al., 2016), covering eleven criteria is necessary for each dataset.”
BackgroundMethodInfluentialSelf-citationNetwork Intrusion Detection and Prevention - Concepts and Techniques
Ghorbani, A., Lu, W., & Tavallaee, M. (2009) · Advances in Information Security · doi:10.1007/978-0-387-88771-5 · Cited by 175 · cited 1×
“Since 1999, Scott et al. (Scott and Wilkins, 1999), Heideman and Papadopulus (Heidemann and Papdopoulos, 2009), Ghorbani et al. (Ghorbani Ali and Mahbod, 2010), Nehinbe (Nehinbe, 2011), Shiravi et al. (Ali Shiravi and Ghorbani, 2012), and Sharfaldin et al. (Gharib et al., 2016) tried to propose an…”
BackgroundSelf-citationA Labeled Data Set for Flow-Based Intrusion Detection
Sperotto, A., Sadre, R., van Vliet, F., & Pras, A. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04968-2_4 · Cited by 155 · cited 1×
“It is labelled and is more realistic, but the lack of volume and diversity of attacks is obvious (Sperotto et al., 2009).”
Background
Cited by
Sorted by citations
Items 501–600 of 1,010
Dong, W., Yu, J., Lin, X., Gou, G., & Xiong, G. (2024) · Neurocomputing · doi:10.1016/j.neucom.2024.128444 · Cited by 68
Machine learning-inspired intrusion detection system for IoT: Security issues and future challenges
Ahanger, T. A., Ullah, I., Algamdi, S. A., & Tariq, U. (2025) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2025.110265 · Cited by 53
Han, H., Kim, H., & Kim, Y. (2022) · Symmetry · doi:10.3390/sym14010161 · Cited by 51
Borderline SMOTE Algorithm and Feature Selection-Based Network Anomalies Detection Strategy
Sun, Y. M., Que, H., Cai, Q., et al. (2022) · Energies · doi:10.3390/en15134751 · Cited by 51
Analysis of Continual Learning Models for Intrusion Detection System
Prasath, S., Sethi, K., Mohanty, D. K., Bera, P., & Samantaray, S. R. (2022) · IEEE Access · doi:10.1109/access.2022.3222715 · Cited by 50
“A distinguishing feature of the CICIDS 2017 dataset is that it is more realistic and also has a reliable benchmarking that follows the 11 step approach proposed in [40].”
MethodEvasion Attack and Defense on Machine Learning Models in Cyber-Physical Systems: A Survey
Wang, S., Ko, R. K. L., Bai, G., Dong, N., Choi, T., & Zhang, Y. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3344808 · Cited by 64
“The experiment is conducted on the Kitsune [168] and CICIDS2017 [184] network traffic datasets with high evasion success rate reported.”
MethodKamal, H., & Mashaly, M. E. (2024) · Future Internet · doi:10.3390/fi16120481 · Cited by 51
An Anomaly-Based Intrusion Detection System for the Smart Grid Based on CART Decision Tree
Grammatikis, P. I. R., & Sarigiannidis, P. G. (2018) · Global Information Infrastructure and Networking Symposium · doi:10.1109/giis.2018.8635743 · Cited by 51
“The generation of the particular decision tree was based on the CART algorithm and the CICIDS2017 dataset [11].”
BackgroundMethodInfluentialA Local Feature Engineering Strategy to Improve Network Anomaly Detection
Carta, S., Podda, A. S., Recupero, D. R., & Saia, R. (2020) · Future Internet · doi:10.3390/fi12100177 · Cited by 51
“• CICIDS2017 [114]: This dataset (hereafter, CIC) involves network activity based on the HTTP, HTTPS, FTP, SSH, and email protocols, related to normal events and several intrusion attacks such as Brute Force SSH, Brute Force FTP, Denial of Service, Infiltration, Heartbleed, Web Attack, Botnet, and Distributed Denial o…”
MethodStacked Autoencoder-Based Probabilistic Feature Extraction for On-Device Network Intrusion Detection
Dao, T.-N., & Lee, H. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3078292 · Cited by 51
“We evaluate the feasibility of our network intrusion detection algorithm on two real-world network traffic data sets: 1) UNSW-NB15 [28] and 2) CICIDS [29].”
MethodReal-time Distributed-Random-Forest-Based Network Intrusion Detection System Using Apache Spark
Zhang, H., Dai, S., Li, Y., & Zhang, W. (2018) · IEEE International Performance, Computing, and Communications Conference · doi:10.1109/pccc.2018.8711068 · Cited by 53
“First, softflowd relays the PCAP file contained in the CICIDS2017 dataset to simulate real network data traffic.”
BackgroundMethodInfluentialAdaptive Intrusion Detection in the Networking of Large-Scale LANs With Segmented Federated Learning
Sun, Y., Esaki, H., & Ochiai, H. (2020) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2020.3044323 · Cited by 50
“The CICIDS2017 [21] Intrusion Detection evaluation dataset was used, consisting of benign data samples, distributed denial-of-service (DDoS) attacks, and port scan attacks.”
MethodA bibliometric analysis of cyber security and cyber forensics research
Sharma, D., Mittal, R., Sekhar, R., Shah, P., & Renz, M. (2023) · Results in Control and Optimization · doi:10.1016/j.rico.2023.100204 · Cited by 53
Chen, J., Zhao, Y., Li, Q. L., Feng, X., & Xu, K. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3297369 · Cited by 54
“The basic experiments setting is as follows: 1) Datasets: We choose four network intrusion attack datasets to evaluate our defense, including KDDCUP’99 [38], Mirai botnet [12], CIC-IDS2017 [39], and UNSW-NB15 [40].”
BackgroundAnomaly and intrusion detection using deep learning for software-defined networks: A survey
Ruffo, V. G. D. S., Lent, D. M. B., Komarchesqui, M., Schiavon, V. F., de Assis, M. V. O., Carvalho, L. F., & Proença, M. L. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.124982 · Cited by 62
Belachew, H. M., Beyene, M. Y., Desta, A. B., et al. (2025) · IEEE Access · doi:10.1109/access.2025.3526692 · Cited by 50
Cyber Attack Prediction: From Traditional Machine Learning to Generative Artificial Intelligence
Ankalaki, S., Atmakuri, A. R., Pallavi, M., Hukkeri, G. S., Jan, T., & Naik, G. R. (2025) · IEEE Access · doi:10.1109/access.2025.3547433 · Cited by 72
Robust Detection of Malicious Encrypted Traffic via Contrastive Learning
Shen, M., Wu, J., Ye, K., Xu, K., Xiong, G., & Zhu, L. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3560560 · Cited by 56
“The datasets are CIC-IDS-2017 [24], CIC-DDoS-2019 [25], and DoHBrw-2020 [26], which contain various types of malicious tra ffi c, such as DoS / DDoS, Brute Force, Portscan, and DNS Tunneling attacks (see Table III for more details).”
InfluentialDeep learning-based intrusion detection for IoT networks: a scalable and efficient approach
Hossain, M. A. (2025) · EURASIP Journal on Information Security · doi:10.1186/s13635-025-00202-w · Cited by 50
Have it Your Way: Generating Customized Log Datasets With a Model-Driven Simulation Testbed
Landauer, M., Skopik, F., Wurzenberger, M., et al. (2020) · IEEE Transactions on Reliability · doi:10.1109/tr.2020.3031317 · Cited by 50
“IDS deployment as well as attack execution in controlled environments [3], [4].”
BackgroundChoobdar, P., Naderan, M., & Naderan, M. (2021) · Wireless Personal Communications · doi:10.1007/s11277-021-09139-y · Cited by 53
“Furthermore, the number and labels of attacks in this dataset are reported in Table 6 [60].”
BackgroundThe Proposition and Evaluation of the RoEduNet-SIMARGL2021 Network Intrusion Detection Dataset
Mihăilescu, M.-E., Mihai, D., Carabaș, M., Komisarek, M., Pawlicki, M., Hołubowicz, W., & Kozik, R. (2021) · Sensors · doi:10.3390/s21134319 · Cited by 51
“NSL-KDD [14], UNSW-NB15 [15], and CICIDS2017 [16] datasets are used to verify the performance of the proposed solution.”
BackgroundMethodData Transformation Schemes for CNN-Based Network Traffic Analysis: A Survey
Krupski, J., Graniszewski, W., & Iwanowski, M. (2021) · Electronics · doi:10.3390/electronics10162042 · Cited by 49
“ISCX-IDS-2017 malware 16 types of attacks: Brute Force (FTP-Patator, SSH-Patator), DoS/DDoS (DoS slowloris, DoS Slowhttptest, DoS Hulk, DoS GoldenEye, DDoS LOIT), Web Attacks (Brute Force, XSS, SQL Injection), Infiltrations (Dropbox download, Cool disk – MAC), Bugs/Exploits (Heartbleed, Meta exploit Win Vista), Botnet…”
BackgroundFarrukh, Y. A., Khan, I., Wali, S. W., Bierbrauer, D., Pavlik, J. A., & Bastian, N. D. (2022) · IEEE/ACM International Conference on Big Data Computing, Applications and Technologies (BDCAT) · doi:10.1109/bdcat56447.2022.00015 · Cited by 50
“2) CIC-IDS2017 : The CIC-IDS2017 intrusion detection dataset is specifically developed to represent more modern network flows, and attacks than the preceding datasets mentioned in Table I [41].”
BackgroundA Case Study on using Deep Learning for Network Intrusion Detection
Fernandez, G. C., & Xu, S. (2019) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom47813.2019.9020824 · Cited by 57
“The CIC IDS 2017 dataset [10] improves the ISCX IDS 2012 dataset by containing, along with benign traffic, attack traffic from seven different kinds of attacks (i.e., brute-force against the SSH and Web, Heartbleed, botnet, denial of service (DoS), distributed denial of service (DDoS), cross-site…”
BackgroundA Novel SDN Dataset for Intrusion Detection in IoT Networks
Sarica, A. K., & Angın, P. (2020) · International Conference on Network and Service Management (CNSM) · doi:10.23919/cnsm50824.2020.9269042 · Cited by 65
“4) CICIDS2017 dataset [7] was created by the Canadian Institute of Cybersecurity.”
MethodA Hybrid Deep Learning Anomaly Detection Framework for Intrusion Detection
Kale, R., Lu, Z., Fok, K. W., et al. (2022) · IEEE International Conference on Big Data Security on Cloud, IEEE International Conference on High Performance and Smart Computing, and IEEE International Conference on Intelligent Data and Security (BigDataSecurity/HPSC/IDS) · doi:10.1109/bigdatasecurityhpscids54978.2022.00034 · Cited by 48
“For CIC-IDS2018, the classification across different classes is generally accurate as shown in Fig 3.”
BackgroundMethodInfluentialTruong, V. T., & Le, L. B. (2023) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2023.3312299 · Cited by 48
Network traffic classification based on federated semi-supervised learning
Wang, Z., Li, Z., Fu, M., et al. (2024) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2024.103091 · Cited by 48
Enhancing Intrusion Detection Systems Using a Deep Learning and Data Augmentation Approach
Mohammad, R., Saeed, F., Almazroi, A. A., Alsubaei, F. S., & Almazroi, A. A. (2024) · Systems · doi:10.3390/systems12030079 · Cited by 79
Planter: Rapid Prototyping of In-Network Machine Learning Inference
Zheng, C., Zang, M., Hong, X., et al. (2024) · ACM SIGCOMM Computer Communication Review · doi:10.1145/3687230.3687232 · Cited by 48
Sequence Aggregation Rules for Anomaly Detection in Computer Network TrafficPreprint
Radford, B. J., Richardson, B. D., & Davis, S. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.03735 · Cited by 50
Meta-Learning to Improve Unsupervised Intrusion Detection in Cyber-Physical Systems
Zoppi, T., Gharib, M., Atif, M., & Bondavalli, A. (2021) · ACM Transactions on Cyber-Physical Systems · doi:10.1145/3467470 · Cited by 49
“Our selection process resulted in the following datasets NSL-KDD (2009) [35], CTU-13 (2011) [40], ISCX12 (2012) [34], UNSW-NB15 (2015) [37], UGR16 (2016) [42], NGIDS-DS (2017), Netflow-IDS (2017) [39], AndMal17 (2017) [41], CIDDS001 (2017) [36], CICIDS17 (2017) [38], and CICIDS18 (2018) [38].”
Long-Term Prediction of Network Security Situation Through the Use of the Transformer-Based Model
Yin, K., Yu, Y., Yao, C., & Yang, J. (2022) · IEEE Access · doi:10.1109/access.2022.3175516 · Cited by 52
“It contains detailed descriptions of intrusion and abstraction distribution models for applications, protocols, or lower-level network entities, as well as network traffic for each computer including the victim, log files, and 80 network traffic features extracted from captured traffic using the network traffic genera…”
MethodReal-Time Anomaly Detection of Network Traffic Based on CNN
Liu, H., & Wang, H. (2023) · Symmetry · doi:10.3390/sym15061205 · Cited by 47
“It was It was found that the traffic classification accuracy on the CICIDS2017 dataset is more than 99.88%. that the traffic classification accuracy on the CICIDS2017 than 99.88%.”
BackgroundMethodInfluentialBarhoush, M. M., Abed-alguni, B. H., & Al-qudah, N. E. A. (2023) · The Journal of Supercomputing · doi:10.1007/s11227-023-05444-4 · Cited by 47
Xu, H., Sun, L., Fan, G., Li, W., & Kuang, G. (2023) · IEEE Access · doi:10.1109/access.2023.3290613 · Cited by 47
“CIC-IDS2017 dataset is a network intrusion detection dataset designed, collected and processed by the Canadian Institute for Cybersecurity Research in 2017 [31].”
MethodA network intrusion detection system based on deep learning in the IoT
Wang, X., Dai, L., & Yang, G. (2024) · The Journal of Supercomputing · doi:10.1007/s11227-024-06345-w · Cited by 47
“In order to assess the effectiveness of the suggested DL approach for network intrusion detection, the UNSW-NB15 [72], CIC-IDS2018 [73], and CIC-IOT2023 [74] datasets were selected.”
Nazir, A., He, J., Zhu, N., Wajahat, A., Ullah, F., Qureshi, S., & Pathan, M. S. (2025) · The Journal of Supercomputing · doi:10.1007/s11227-025-07255-1 · Cited by 47
Unsupervised Machine Learning Techniques for Network Intrusion Detection on Modern Data
Verkerken, M., D’hooge, L., Wauters, T., et al. (2020) · Cyber Security in Networking Conference (CSNet) · doi:10.1109/csnet50428.2020.9265461 · Cited by 48
“The CIC-IDS-2017 dataset [11], used in this paper, sets the new norm as it is the first to satisfy all the criteria and thus recommended to use as evaluation dataset [12].”
MethodUnsupervised Anomaly Detectors to Detect Intrusions in the Current Threat Landscape
Zoppi, T., Ceccarelli, A., Capecchi, T., & Bondavalli, A. (2021) · ACM/IMS Transactions on Data Science · doi:10.1145/3441140 · Cited by 53
“• (2018) CICIDS18 [20].”
InfluentialA Design of an Integrated Cloud-based Intrusion Detection System with Third Party Cloud Service
Elmasry, W., Akbulut, A., & Zaim, A. H. (2021) · Open Computer Science · doi:10.1515/comp-2020-0214 · Cited by 50
“Hence, they reported that a subset of 23 features is the optimal feature set for all attack types [57].”
BackgroundRandom Forest Based on Federated Learning for Intrusion Detection
Markovic, T., León, M., Buffoni, D., & Punnekkat, S. (2022) · IFIP advances in information and communication technology · doi:10.1007/978-3-031-08333-4_11 · Cited by 55
Evaluation of Machine Learning Techniques for Traffic Flow-Based Intrusion Detection
Rodríguez, M., Alesanco, Á., Mehavilla, L., et al. (2022) · Sensors · doi:10.3390/s22239326 · Cited by 47
SliceSecure: Impact and Detection of DoS/DDoS Attacks on 5G Network Slices
Khan, M. S., Farzaneh, B., Shahriar, N., Saha, N., & Boutaba, R. (2022) · IEEE Future Networks World Forum (FNWF) · doi:10.1109/fnwf55208.2022.00117 · Cited by 47
“Many data sets including CICDoS, CICIDS2017, CSE-CICIDS2018 [3], and CIC-DDoS2019 [4] are available for DoS/DDoS attacks.”
BackgroundMethodBakır, H., & Ceviz, Ö. (2024) · Arabian Journal for Science and Engineering · doi:10.1007/s13369-024-08949-z · Cited by 55
Machine Learning Based DDos Detection Through NetFlow Analysis
Hou, J., Fu, P., Cao, Z., et al. (2018) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom.2018.8599738 · Cited by 46
“The dataset CIC-IDS-2017 is produced by the Canadian Institute for Cybersecurity, including benign and the most up-to-date common attacks.”
MethodInfluentialEffectiveness of Machine Learning Based Intrusion Detection Systems
Alrowaily, M., Alenezi, F. N., & Lu, Z. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-24907-6_21 · Cited by 46
“In this paper, we utilize the public real-world intrusion dataset CICIDS2017 [7], which includes benign and the most sophisticated attacks and presenting results of seven machine learning classifiers, such as AdaBoost, Naive-Bayes (NB), Random Forest(RF), Decision Tree, Multi-layer perceptron (MLP), K-Nearest Neighbor…”
BackgroundMethodInfluentialDetecting Cybersecurity Attacks Using Different Network Features with LightGBM and XGBoost Learners
Leevy, J. L., Hancock, J., Zuech, R., & Khoshgoftaar, T. M. (2020) · IEEE International Conference on Cognitive Machine Intelligence (CogMI) · doi:10.1109/cogmi50398.2020.00032 · Cited by 54
“CICIDS2017 is the predecessor of the 2018 dataset.”
BackgroundMethodInfluentialA Hybrid Intelligent Framework to Combat Sophisticated Threats in Secure Industries
Javeed, D., Gao, T., Khan, M. T., & Shoukat, D. (2022) · Sensors · doi:10.3390/s22041582 · Cited by 47
MEMBER: A multi-task learning model with hybrid deep features for network intrusion detection
Lan, J., Liu, X., Li, B., Sun, J., Li, B., & Zhao, J. W. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102919 · Cited by 45
Robust Self-Protection Against Application-Layer (D)DoS Attacks in SDN Environment
Benzaïd, C., Boukhalfa, M., & Taleb, T. (2020) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc45663.2020.9120472 · Cited by 45
“The MLP-based model integrated in the Detector module is trained on the recent intrusion detection dataset, CI- 1https://onosproject.org 2https://github.com/grafov/hulk 3https://github.com/gkbrk/slowloris 4https://github.com/tensorflow/cleverhans CIDS2017 [23] (where only network flows corresponding to legitimate traf…”
MethodA Systematic Review on Anomaly Detection for Cloud Computing Environments
Hagemann, T., & Katsarou, K. (2020) · Artificial Intelligence and Cloud Computing Conference (AICCC) · doi:10.1145/3442536.3442550 · Cited by 60
A Novel Intrusion Detection Approach Using Machine Learning Ensemble for IoT Environments
Verma, P., Dumka, A., Singh, R., Ashok, A., Gehlot, A., Malik, P. K., Gaba, G. S., & Hedabou, M. (2021) · Applied Sciences · doi:10.3390/app112110268 · Cited by 46
A Deep LSTM based Approach for Intrusion Detection IoT Devices Network in Smart Home
Azumah, S. W., ElSayed, Z., Adewopo, V. A., Zaghloul, Z. S., & Li, C. (2021) · IEEE World Forum on Internet of Things (WF-IoT) · doi:10.1109/wf-iot51360.2021.9596033 · Cited by 53
Aswad, F. M., Ahmed, A. M. S., Alhammadi, N. A. M., Khalaf, B. A., & Mostafa, S. A. (2023) · Journal of Intelligent Systems · doi:10.1515/jisys-2022-0155 · Cited by 46
“In addition, it contains the results of a network traffic analysis performed through CICFlowMeter, featuring flows labeled according to the time stamp, source and destination IP addresses, source and destination ports, protocols, and attack [13].”
BackgroundMethodThreat Detection and Mitigation for Tactile Internet Driven Consumer IoT-Healthcare System
Rajesh, R., Hemalatha, S., Nagarajan, S. M., et al. (2024) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2024.3370193 · Cited by 45
“The CICIDS-2017 dataset [24] represents a significant step towards enhancing the realism of network traffic records in the context of intrusion detection.”
BackgroundA multi-agent adaptive deep learning framework for online intrusion detection
Soltani, M., Khajavi, K., Siavoshani, M. J., & Jahangir, A. H. (2024) · Cybersecurity · doi:10.1186/s42400-023-00199-0 · Cited by 64
“Their evaluation is based on the pre-extracted features of the NSL-KDD, CIDDS-001, and CIC-IDS2017 datasets.”
BackgroundInfluentialTowards Real-Time Network Intrusion Detection With Image-Based Sequential Packets Representation
Ghadermazi, J., Shah, A., & Bastian, N. D. (2024) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2024.3403394 · Cited by 45
“Packet header data is typically used to obtain flow-based features [1], using publicly available tools like CIC FlowMeter [4].”
InfluentialNetwork Intrusion Detection: An IoT and Non IoT-Related Survey
Abdulkareem, S. A., Foh, C. H., Shojafar, M., Carrez, F., & Moessner, K. (2024) · IEEE Access · doi:10.1109/access.2024.3473289 · Cited by 47
“Researchers also began exploring other software tools for their work, most notably Python used by authors in [58] and [95] and R used by authors in [91] and [92].”
BackgroundMethodIntrusion Detection Framework for Internet of Things with Rule Induction for Model Explanation
Adewole, K. S., Jacobsson, A., & Davidsson, P. (2025) · Sensors · doi:10.3390/s25061845 · Cited by 54
“The features in the CIC-IDS2017 were extracted using CICFlowMeter, which is capable of extracting features relating to both forward and backward direction of network traffic-flow data [30].”
Farrukh, Y. A., Wali, S. W., Khan, I., & Bastian, N. D. (2025) · Expert Systems with Applications · doi:10.1016/j.eswa.2025.128089 · Cited by 62
Exploring edge TPU for network intrusion detection in IoT
Hosseininoorbin, S., Layeghy, S., Sarhan, M., Jurdak, R., & Portmann, M. (2023) · Journal of Parallel and Distributed Computing · doi:10.1016/j.jpdc.2023.05.001 · Cited by 45
“In the binary classification between DDoS / non-DDoS, the method achieved 98.03% accuracy on CIC-IDS2017 dataset [16].”
MethodInfluentialDeveloping new deep-learning model to enhance network intrusion classification
Azzaoui, H., Boukhamla, A. Z. E., Arroyo, D., et al. (2021) · Evolving Systems · doi:10.1007/s12530-020-09364-z · Cited by 44
“To overcome older datasets and meets real-world criteria, Canadian Institute for Cyber-security has created, among other newer datasets, the CICIDS2017 dataset among other newer ones (Sharafaldin et al. 2018).”
BackgroundMethodInfluentialIntelligent Traffic Management in Next-Generation Networks
Aouedi, O., Piamrat, K., & Parrein, B. (2022) · Future Internet · doi:10.3390/fi14020044 · Cited by 45
Deep Learning Model Transposition for Network Intrusion Detection Systems
Figueiredo, J., Serrão, C., & de Almeida, A. (2023) · Electronics · doi:10.3390/electronics12020293 · Cited by 50
Harini, R., Maheswari, N., Ganapathy, S., & Sivagami, M. (2023) · Alexandria Engineering Journal · doi:10.1016/j.aej.2023.07.063 · Cited by 51
Gou, W., Zhang, H., & Zhang, R. (2023) · Sensors · doi:10.3390/s23218788 · Cited by 44
“We validate the efficacy of this approach by using the CICIDS2017 [11].”
BackgroundMethodMulti-objective optimization algorithms for intrusion detection in IoT networks: A systematic review
Sharma, S., Kumar, V., & Dutta, K. (2024) · Internet of Things and Cyber-Physical Systems · doi:10.1016/j.iotcps.2024.01.003 · Cited by 49
Zukaib, U., Cui, X., Zheng, C., Dong, L., & Din, S. U. (2024) · Journal of Parallel and Distributed Computing · doi:10.1016/j.jpdc.2024.104934 · Cited by 48
A lightweight SEL for attack detection in IoT/IIoT networks
Abdulkareem, S. A., Foh, C. H., Carrez, F., & Moessner, K. (2024) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2024.103980 · Cited by 49
A content-based deep intrusion detection system
Soltani, M., Siavoshani, M. J., & Jahangir, A. H. (2021) · International Journal of Information Security · doi:10.1007/s10207-021-00567-2 · Cited by 46
“It includes more benign profiles and attack version [40].”
BackgroundMethodInfluentialTowards Effective Detection of Recent DDoS Attacks: A Deep Learning Approach
Lopes, I. O., Zou, D., Ruambo, F. A., Akbar, S., & Yuan, B. (2021) · Security and Communication Networks · doi:10.1155/2021/5710028 · Cited by 44
Network traffic analysis over clustering-based collective anomaly detection
Wang, C., Zhou, H., Hao, Z., Hu, S., Li, J., Zhang, X., Jiang, B., & Chen, X. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.108760 · Cited by 44
MidSiot: A Multistage Intrusion Detection System for Internet of Things
Nguyen, D.-T., Xuan-Ninh, H., & Le, K.-H. (2022) · Wireless Communications and Mobile Computing · doi:10.1155/2022/9173291 · Cited by 52
Krishnaveni, S., Chen, T. M., Sathiyanarayanan, M., & Amutha, B. (2024) · Cluster Computing · doi:10.1007/s10586-024-04320-x · Cited by 44
Leveraging siamese networks for one-shot intrusion detection model
Hindy, H., Tachtatzis, C., Atkinson, R. C., Brosset, D., Bureš, M., Andonović, I., Michie, C., & Bellekens, X. (2022) · Journal of Intelligent Information Systems · doi:10.1007/s10844-022-00747-z · Cited by 50
Adaptative Perturbation Patterns: Realistic Adversarial Learning for Robust Intrusion Detection
Vitorino, J., Oliveira, N. R. B. D., & Praça, I. (2022) · Future Internet · doi:10.3390/fi14040108 · Cited by 51
“CIC-IDS2017 [37] consists of 7 captures of cyber-attacks performed on a standard Enterprise computer network with 25 interacting users.”
BackgroundErrors in the CICIDS2017 Dataset and the Significant Differences in Detection Performances It Makes
Lanvin, M., Gimenez, P.-F., Han, Y., Majorczyk, F., Mé, L., & Totel, É. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-31108-6_2 · Cited by 68
“In 2018, the Canadian Institue for Cybersecurity (CIC) provided the CICIDS2017 dataset [14] and, together with the Communications Security Establishment, the CSE-CIC-IDS2018 [3].”
MethodExtreme minority class detection in imbalanced data for network intrusion
Milosevic, M., & Ciric, V. M. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102940 · Cited by 43
Shyaa, M. A., Zainol, Z. B., Abdullah, R., et al. (2023) · Sensors · doi:10.3390/s23073736 · Cited by 43
“CICIDS-2017: Covers benign and up-to-date frequent attacks and contains 80 features [46].”
BackgroundMethodSGAN-IDS: Self-Attention-Based Generative Adversarial Network against Intrusion Detection Systems
Aldhaheri, S., & Alhuzali, A. (2023) · Sensors · doi:10.3390/s23187796 · Cited by 57
Sharma, A., & Lashkari, A. H. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110984 · Cited by 54
Self-citationTowards Explainable Network Intrusion Detection using Large Language Models
Houssel, P. R. B., Singh, P., Layeghy, S., & Portmann, M. (2024) · IEEE/ACM International Conference on Big Data Computing, Applications and Technologies (BDCAT) · doi:10.1109/bdcat63179.2024.00021 · Cited by 48
“These could potentially be employed as a complementary solution, aiming to enhance the explain-ability of NIDS.”
Cao, X., Nan, G., Guo, H. X., Mu, H., Wang, L., Lin, Y., Zhou, Q., Li, J., Qin, B., Cui, Q., et al. (2025) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2025.3560042 · Cited by 54
“As widely used attack datasets in the current cybersecurity field, CICIDS2017 [35], CICIoMT2024 [36], CICIoV2024 [37], and CICIoT2023 [38] collect the attack data for normal network scenarios, healthcare IoT scenarios, automotive scenarios, and IoT scenarios, respectively.”
Feed-forward neural network for Network Intrusion Detection
Rosay, A., Carlier, F., & Leroux, P. (2020) · IEEE Vehicular Technology Conference · doi:10.1109/vtc2020-spring48590.2020.9129472 · Cited by 53
“Therefore, it is possible to use common network intrusion detection data sets like KDD-Cup99 [3], NSL-KDD [4] or CICIDS2017 [5] containing different types of attacks against computers or servers.”
BackgroundMethodGADoT: GAN-based Adversarial Training for Robust DDoS Attack Detection
Abdelaty, M., Scott-Hayward, S., Doriguzzi-Corin, R., et al. (2021) · IEEE Conference on Communications and Network Security · doi:10.1109/cns53000.2021.9705040 · Cited by 42
SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection
Apruzzese, G., Laskov, P., & Schneider, J. (2023) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp57164.2023.00042 · Cited by 73
Rodríguez, D. Z., Okey, O. D., Maidin, S. S., Udo, E. U., & Kleinschmidt, J. H. (2023) · PLoS ONE · doi:10.1371/journal.pone.0286652 · Cited by 54
Shafi, M., Lashkari, A. H., Rodriguez, V., & Nevo, R. (2024) · Information · doi:10.3390/info15040195 · Cited by 45
Self-citationA Novel Hybrid Unsupervised Learning Approach for Enhanced Cybersecurity in the IoT
Kaliyaperumal, P., Periyasamy, S., Manikandan, T., Balusamy, B., & Benedetto, F. (2024) · Future Internet · doi:10.3390/fi16070253 · Cited by 48
“In 2018, the Canadian Institute of Cybersecurity (CIC) collaborated with the Communications Security Establishment (CSE) to develop the CSECIC-IDS2018 dataset [36].”
MethodInfluentialAn Intrusion Action-Based IDS Alert Correlation Analysis and Prediction Framework
Zhang, K., Zhao, F., Luo, S., et al. (2019) · IEEE Access · doi:10.1109/access.2019.2946261 · Cited by 42
Musafer, H., Abuzneid, A., Faezipour, M., et al. (2020) · Electronics · doi:10.3390/electronics9020259 · Cited by 42
“This section briefly glances at intrusion detection algorithms related to the use of the CICIDS2017 dataset [10], which are developed mainly based on machine and deep learning techniques.”
MethodAdversarial Attack Against DoS Intrusion Detection: An Improved Boundary-Based Method
Peng, X., Huang, W., & Shi, Z. (2019) · IEEE International Conference on Tools with Artificial Intelligence (ICTAI) · doi:10.1109/ictai.2019.00179 · Cited by 49
“For KDDcup99, the input dimension of the ANN model is 41 and the last layer is a softmax with 39 outputs, while 14 and 6 for CICIDS2017.”
BackgroundInfluentialA Neural Attention Model for Real-Time Network Intrusion Detection
Tan, M., Iacovazzi, A., Cheung, N. M., & Elovici, Y. (2019) · Conference on Local Computer Networks · doi:10.1109/lcn44214.2019.8990890 · Cited by 50
2L-ZED-IDS: A Two-Level Anomaly Detector for Multiple Attack Classes
Catillo, M., Rak, M., & Villano, U. (2020) · Advances in intelligent systems and computing · doi:10.1007/978-3-030-44038-1_63 · Cited by 42
Sharma, M., Pant, S., Sharma, D. K., Gupta, K. D., Vashishth, V., & Chhabra, A. (2020) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.4137 · Cited by 43
“The DEFCON-8 dataset, 37,41 though it has limited capability of evaluating IDS systems, consists of port scanning and buffer overflow attacks.”
BackgroundMao, B., Liu, J., Lai, Y., & Sun, M. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108340 · Cited by 43
Sambangi, S., Lakshmeeswari, G., & Aljawarneh, S. A. (2022) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2022.107955 · Cited by 41
Continual Learning for Anomaly based Network Intrusion Detection
Amalapuram, S. K., Tadwai, A., Vinta, R., Channappayya, S. S., & Tamma, B. R. (2022) · International Conference on Communication Systems & Networks (COMSNETS) · doi:10.1109/comsnets53615.2022.9668482 · Cited by 43
Metadata
- Authors
- Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A.
- Affiliations
- University of New Brunswick (CA)
- University of New Brunswick (UNB), Canada
- Venue
- Proceedings of the 4th International Conference on Information Systems Security and Privacy
- Published
- 2018
- Pages
- 108-116
- OpenAlex
- W2789828921
- Cited by
- 5,318
- References
- 27
- Citations by year
- 2026: 1170 · 2025: 1032 · 2024: 803 · 2023: 704 · 2022: 558 · 2021: 518 · 2020: 332 · 2019: 165 · 2018: 35
- FWCI
- 215.46
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- cc-by-nc-nd
- Locations
- International Conference on Information Systems Security and Privacy (ICISSP) (publishedVersion, cc-by-nc-nd)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- intrusion detection, intrusion detection datasets, network traffic characterization, network security, dataset construction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
