The DOI matches its Crossref record; 20 of the 27 references it cites were found in a registry or an index.
Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization
Open accessOverview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Many studies classify feature selection methods into three categories: filter-based techniques, wrapper techniques, and embed techniques”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [210]
Citations
Cites
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396 · cited 3×
“KDD’99 (University of California, Irvine 1998-99): This dataset is an updated version of the DARPA98, by processing the tcpdump portion.”
BackgroundMethodSelf-citationTesting Intrusion detection systems
McHugh, J. (2000) · ACM Transactions on Privacy and Security · doi:10.1145/382912.382923 · Cited by 1,490 · cited 4×
“Moreover, it lacks actual attack data records (McHugh, 2000) (Brown et al.”
BackgroundMethodInfluentialToward developing a systematic approach to generate benchmark datasets for intrusion detection
Shiravi, A., Shiravi, H., Tavallaee, M., & Ghorbani, A. A. (2012) · Computers & Security · doi:10.1016/j.cose.2011.12.012 · Cited by 1,345
Self-citationCharacterization of Tor Traffic using Time based Features
Lashkari, A. H., Gil, G. D., Mamun, M., & Ghorbani, A. A. (2017) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0006105602530262 · Cited by 926 · cited 3×
“We begin to extract the 80 traffic features from the dataset using CICFlowMeter (CICFlowMeter, 2017),(Habibi Lashkari et al., 2017).”
MethodSelf-citationStatistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation
Song, J., Takakura, H., Okabe, Y., Eto, M., Inoue, D., & Nakao, K. (2011) · International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security · doi:10.1145/1978672.1978676 · Cited by 335 · cited 2×
“The normal traffic here has been simulated repeatedly during the attacks and producing only DNS and mail traffic data, which is not reflected in real world normal network traffic, so there are no false positives, which are important for minimizing the number of alerts (Song et al., 2011) (M.”
BackgroundGeneration of a new IDS test dataset: Time to retire the KDD collection
Creech, G., & Hu, J.-K. (2013) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc.2013.6555301 · Cited by 326 · cited 1×
“ADFA (University of New South Wales 2013): This dataset includes normal training and validating data and 10 attacks per vector (Creech and Hu, 2013).”
MethodTowards a Reliable Intrusion Detection Benchmark Dataset
Sharafaldin, I., Gharib, A., Lashkari, A. H., & Ghorbani, A. A. (2017) · Software Networking · doi:10.13052/jsn2445-9739.2017.009 · Cited by 309 · cited 9×
“Finally, we evaluate the quality of the generated dataset by searching for common mistakes and criticisms of other synthetically created datasets, based on the 11 criteria from the last proposed dataset evaluation framework by Canadian Institute for Cybersecurity (CIC)(Sharafaldin et al., 2017).”
MethodInfluentialSelf-citationAn Evaluation Framework for Intrusion Detection Dataset
Gharib, A., Sharafaldin, I., Lashkari, A. H., et al. (2016) · International Conferences on Information Science and System · doi:10.1109/icissec.2016.7885840 · Cited by 224 · cited 6×
“Regarding to the last dataset evaluation framework published on 2016 (Gharib et al., 2016), covering eleven criteria is necessary for each dataset.”
BackgroundMethodInfluentialSelf-citationNetwork Intrusion Detection and Prevention - Concepts and Techniques
Ghorbani, A., Lu, W., & Tavallaee, M. (2009) · Advances in Information Security · doi:10.1007/978-0-387-88771-5 · Cited by 175 · cited 1×
“Since 1999, Scott et al. (Scott and Wilkins, 1999), Heideman and Papadopulus (Heidemann and Papdopoulos, 2009), Ghorbani et al. (Ghorbani Ali and Mahbod, 2010), Nehinbe (Nehinbe, 2011), Shiravi et al. (Ali Shiravi and Ghorbani, 2012), and Sharfaldin et al. (Gharib et al., 2016) tried to propose an…”
BackgroundSelf-citationA Labeled Data Set for Flow-Based Intrusion Detection
Sperotto, A., Sadre, R., van Vliet, F., & Pras, A. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04968-2_4 · Cited by 155 · cited 1×
“It is labelled and is more realistic, but the lack of volume and diversity of attacks is obvious (Sperotto et al., 2009).”
Background
Cited by
Sorted by citations
Items 601–700 of 1,010
An Effective Ensemble Automatic Feature Selection Method for Network Intrusion Detection
Zhang, Y., Zhang, H., & Zhang, B. (2022) · Information · doi:10.3390/info13070314 · Cited by 42
Hybrid Intrusion Detection System Based on Combination of Random Forest and Autoencoder
Wang, C., Sun, Y., Wang, W., Liu, H., & Wang, B. (2023) · Symmetry · doi:10.3390/sym15030568 · Cited by 46
TII-SSRC-23 Dataset: Typological Exploration of Diverse Traffic Patterns for Intrusion Detection
Herzalla, D., Lunardi, W. T., & Lopez, M. A. (2023) · IEEE Access · doi:10.1109/access.2023.3319213 · Cited by 46
“Echoing this methodology, the CICIDS2017 dataset [12] generated a realistic background traffic scenario using the B-Profile system.”
MethodMF-Net: Multi-frequency intrusion detection network for Internet traffic data
Ding, Z., Zhong, G., Qin, X., Li, Q., Fan, Z., Deng, Z., Ling, X., & Xiang, W. (2023) · Pattern Recognition · doi:10.1016/j.patcog.2023.109999 · Cited by 43
Enhancing Network Intrusion Detection Using an Ensemble Voting Classifier for Internet of Things
Farooqi, A. H., Akhtar, S., Rahman, H., Sadiq, T., & Abbass, W. (2023) · Sensors · doi:10.3390/s24010127 · Cited by 44
“Prominent examples of these datasets encompass NSL-KDD, CIC-IDS2017, KDD-CUP, and UNSW-NB15, among others [14,15].”
BackgroundECNet: Robust Malicious Network Traffic Detection With Multi-View Feature and Confidence Mechanism
Han, X., Liu, S., Liu, J., Jiang, B., Lu, Z., & Liu, B. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3426304 · Cited by 43
“To verify the performance comprehensively, we use two basic datasets and reorganize them for evaluation. a) Basic datasets: We use the public dataset CICIDS2018 [26] and the self-collected dataset EnTra2023 as basic datasets.”
MethodData Quality for Security Challenges
Verma, R. M., Zeng, V., & Faridi, H. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363267 · Cited by 41
“The CICIDS2017 dataset is a synthetic dataset consisting of a complete capture of all send and receive traffic from the main switch of the Victim Network [15].”
MethodEvaluating the effectiveness of Adversarial Attacks against Botnet Detectors
Apruzzese, G., Colajanni, M., & Marchetti, M. (2019) · IEEE International Symposium on Network Computing and Applications (NCA) · doi:10.1109/nca.2019.8935039 · Cited by 51
“Previous work also include research efforts [19], [20] based on the deprecated [21] KDD-99 dataset1, and cannot be considered as a good representation of modern large network environments.”
MethodRamos, K. S. H., Monge, M. A. S., & Vidal, J. M. (2020) · Sensors · doi:10.3390/s20164501 · Cited by 41
“[41], where a Random Forest Regressor was used to obtain the behavioral metrics (Subflow_Fwd_Byts, Subflow_Bwd_Byts, TotLen_Fwd_Pkts, TotLen_Bwd_Pkts, Fwd_Pkt_Len_Mean, Bwd_Pkt_Len_Mean, Fwd_Pkts/s and Bwd_Pkts/s) described in Table 1.”
BackgroundMethodAn Empirical Study on Unsupervised Network Anomaly Detection using Generative Adversarial Networks
Truong-Huu, T., Dheenadhayalan, N., Kundu, P. P., Ramnath, V., Jingyi, L., Teo, S. G., & Kadiyala, S. P. (2020) · doi:10.1145/3385003.3410924 · Cited by 45
“We use multiple datasets including UNSW-NB15 [15], CICIDS2017 [20] and Stratosphere IPS [26].”
MethodDetection of anomaly intrusion utilizing self-adaptive grasshopper optimization algorithm
Shukla, A. K. (2020) · Neural Computing and Applications · doi:10.1007/s00521-020-05500-7 · Cited by 42
Verma, J., Bhandari, A., & Singh, G. (2022) · Computer Communications · doi:10.1016/j.comcom.2022.08.022 · Cited by 44
Robust Network Intrusion Detection System Based on Machine-Learning With Early Classification
Kim, T., & Pak, W. (2022) · IEEE Access · doi:10.1109/access.2022.3145002 · Cited by 43
“In this experiment, three datasets were used: ISCX2012, CIC-IDS2017, and CSE-CIC-IDS2018 [33], [34].”
MethodExplainable Artificial Intelligence in Cybersecurity: A Brief Review
Hariharan, S., Velicheti, A., Anagha, A. S., Thomas, C., & Balakrishnan, N. (2021) · doi:10.1109/isea-isap54304.2021.9689765 · Cited by 45
Learn to adapt: Robust drift detection in security domain
Kuppa, A., & Le‐Khac, N. (2022) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2022.108239 · Cited by 41
An efficient DDoS attack detection mechanism in SDN environment
Hnamte, V., & Hussain, J. (2023) · International Journal of Information Technology · doi:10.1007/s41870-023-01332-5 · Cited by 43
“…has been upgraded to include the latest prevalent threats including DoS, DDoS, brute force, cross-site scripting (XSS), SQL injection, botnet, and port scanning [25] There was a 5-day data collection session beginning at 9 a.m. on Monday, July 3, and ending at 5 p.m. on Friday, July 7, 2017.”
BackgroundMethodReddy, D. K. K., Nayak, J., Behera, H. S., Shanmuganathan, V., Viriyasitavat, W., & Dhiman, G. (2024) · Archives of Computational Methods in Engineering · doi:10.1007/s11831-023-10059-2 · Cited by 43
Hussain, A., Tordera, E. M., Masip‐Bruin, X., & Leligou, H. C. (2024) · IEEE Access · doi:10.1109/access.2024.3445261 · Cited by 40
“Inspired by the data labeling from the article [47] which was being used for the development of the CIC-IDS-2018 dataset.”
MethodA privacy-preserving Self-Supervised Learning-based intrusion detection system for 5G-V2X networks
Hossain, S., Senouci, S., Brik, B., & Boualouache, A. (2024) · Ad Hoc Networks · doi:10.1016/j.adhoc.2024.103674 · Cited by 46
Landauer, M., Skopik, F., Stojanović, B., Flatscher, A., & Ullrich, T. (2024) · International Journal of Information Security · doi:10.1007/s10207-024-00921-0 · Cited by 71
Recurrent Neural Network Based Intrusion Detection System
Nayyar, S., Arora, S., & Singh, M. (2020) · International Conference on Communications and Signal Processing (ICCSP) · doi:10.1109/iccsp48568.2020.9182099 · Cited by 52
“This result has been generated on the CIC IDS dataset [3] which has been created under simulated environments.”
BackgroundMethodInfluentialAn Enhanced Deep Autoencoder-based Approach for DDoS Attack Detection
Sindian, S., & Sindian, S. (2020) · WSEAS TRANSACTIONS ON SYSTEMS AND CONTROL · doi:10.37394/23203.2020.15.72 · Cited by 40
“The suggested method experiment is conducted by the CICIDS 2017 [17] dataset instead of the KDD cup dataset using Python [18].”
MethodT-DFNN: An Incremental Learning Algorithm for Intrusion Detection Systems
Data, M., & Aritsugi, M. (2021) · IEEE Access · doi:10.1109/access.2021.3127985 · Cited by 40
“The creator of this dataset [13] did not design this dataset specifically for the incremental learning problem.”
BackgroundInfluentialTowards a Secure Internet of Things: A Comprehensive Study of Second Line Defense Mechanisms
Kamaldeep, Dutta, M., & Granjal, J. (2020) · IEEE Access · doi:10.1109/access.2020.3005643 · Cited by 42
“B-Profile [57] approach is used to generate realistic traffic and it is analyzed with CICFlowMeter [58] with labeled flows based on source and final IP, ports, protocols and timestamps.”
MethodBulavas, V., Marcinkevičius, V., & Rumiński, J. (2021) · Informatica · doi:10.15388/21-infor457 · Cited by 44
MemStream: Memory-Based Streaming Anomaly Detection
Bhatia, S., Jain, A., Srivastava, S., Kawaguchi, K., & Hooi, B. (2022) · International World Wide Web Conference (WWW) · doi:10.1145/3485447.3512221 · Cited by 42
“(3) CICIDS-DoS [79] (5) Ionosphere [80] is derived using the ionosphere dataset from the UCI ML repository [84] which is a binary classification dataset with dimensionality 34.”
MethodHagar, A. A., & Gawali, B. W. (2022) · Computational Intelligence and Neuroscience · doi:10.1155/2022/3131153 · Cited by 39
“Attack names and the number of samples before sampling in Table 1 are available in the “Label” column in the dataset [23].”
BackgroundMethodHeterogeneous Domain Adaptation for IoT Intrusion Detection: A Geometric Graph Alignment Approach
Wu, J., Dai, H., Wang, Y., Ye, K., & Xu, C. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3239872 · Cited by 40
“NI Data Set: CICIDS2017: The CICIDS2017 data set [30] was released in 2017, which served as one of the most upto-date NI data sets with modern attack patterns.”
MethodGotham Testbed: A Reproducible IoT Testbed for Security Experiments and Dataset Generation
Sáez-de-Cámara, X., Flores, J. L., Arellano, C., Urbieta, A., & Zurutuza, U. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3247166 · Cited by 51
Sajid, J., Hayawi, K., Malik, A. W., Anwar, Z., & Trabelsi, Z. (2023) · Applied Sciences · doi:10.3390/app13063857 · Cited by 39
A review on graph-based approaches for network security monitoring and botnet detection
Lagraa, S., Husák, M., Seba, H., Vuppala, S., State, R., & Ouedraogo, M. (2023) · International Journal of Information Security · doi:10.1007/s10207-023-00742-7 · Cited by 54
Chen, X., Wang, P., Yang, Y., et al. (2024) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2024.3373126 · Cited by 39
“2) The CICIDS2017 dataset [27] comprises both regular and seven typical attack network flows to emulate real-world scenarios.”
BackgroundAlharbi, F., & Kashyap, G. S. (2024) · The International journal of networked and distributed computing · doi:10.1007/s44227-024-00032-1 · Cited by 39
“Sharafaldin et al. [13] developed a labelled dataset for intrusion detection systems that contain network traffic attributes that can be used to detect benign or intrusive flows.”
Chen, H., Wang, Z., Yang, S., Luo, X., He, D., & Chan, S. (2024) · Alexandria Engineering Journal · doi:10.1016/j.aej.2024.10.014 · Cited by 45
“CIC IDS2017 dataset: The network traffic characteristics in the CIC IDS2017 dataset were extracted by the Canadian Institute for Cyber Security Research through the CICFlowMeter software [32].”
GTAE-IDS: Graph Transformer-Based Autoencoder Framework for Real-Time Network Intrusion Detection
Ghadermazi, J., Hore, S., Shah, A., & Bastian, N. D. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3557741 · Cited by 48
“We conducted numerical experiments utilizing three widely used publicly available data sets: CIC-IDS2017 [12], CIC-IDS2018 [13], and ACI-IoT-2023 [14].”
DeepGFL: Deep Feature Learning via Graph for Attack Detection on Flow-Based Network Traffic
Yao, Y., Su, L., & Lü, Z. (2018) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom.2018.8599821 · Cited by 39
“Ref [8] shows the selected features and corresponding weight of each section.”
BackgroundMethodInfluentialAn intrusion detection system for packet and flow based networks using deep neural network approach
Farhana, K., Rahman, M., & Ahmed, M. T. (2020) · International Journal of Power Electronics and Drive Systems/International Journal of Electrical and Computer Engineering · doi:10.11591/ijece.v10i5.pp5514-5525 · Cited by 39
“In this study, 24 features including class label [19, 20] have been considered as the best-selected features for detection.”
BackgroundMethodInfluentialA GBDT-Paralleled Quadratic Ensemble Learning for Intrusion Detection System
Yang, J., Sheng, Y., & Wang, J. (2020) · IEEE Access · doi:10.1109/access.2020.3026044 · Cited by 41
“In 2018, a new IDS dataset called CICIDS2017 (Intrusion Detection Evaluation Dataset provided by Canadian Institute for Cybersecurity in 2017) [44] was proposed by Iman et al from Canadian Institute for Cybersecurity.”
MethodFooling intrusion detection systems using adversarially autoencoder
Chen, J., Wu, D., Zhao, Y., Sharma, N., Blumenstein, M., & Yu, S. (2020) · Digital Communications and Networks · doi:10.1016/j.dcan.2020.11.001 · Cited by 39
“For the unidirectional flow, the time of generating 2,000 unidirectional flows (25,683 packets) by using the generated features based on the NSL-KDD dataset is 41.76 s, the time of generating 2,000 unidirectional flows (44,713 packets) by using the generated features based on the UNSW-NB15 dataset is 77.61 s, and the…”
BackgroundInfluentialSynthesis of a Machine Learning Model for Detecting Computer Attacks Based on the CICIDS2017 Dataset
Goryunov, M. N., Matskevich, A. G., & Rybolovlev, D. A. (2020) · Proceedings of the Institute for System Programming of RAS · doi:10.15514/ispras-2020-32(5)-6 · Cited by 39
Federated Learning Empowered End-Edge-Cloud Cooperation for 5G HetNet Security
Wei, Y., Zhou, S., Leng, S., Maharjan, S., & Zhang, Y. (2021) · IEEE Network · doi:10.1109/mnet.011.2000340 · Cited by 39
Wang, Z., Tian, J., Qin, J., Fang, H., & Chen, L. (2021) · Computational Intelligence and Neuroscience · doi:10.1155/2021/7126913 · Cited by 39
“To evaluate the detection effect of the proposed methods, we conduct experiments using the CICIDS-2017 data set [44] and UNSW_NB15 data set [51].”
MethodNetwork Intrusion Detection Model Based on Improved BYOL Self-Supervised Learning
Wang, Z., Li, Z., Wang, J., & Li, D. (2021) · Security and Communication Networks · doi:10.1155/2021/9486949 · Cited by 41
“To verify the powerful detection and generalization capabilities of the improved BYOL intrusion detection model, this paper conducts experiments not only on the old intrusion detection datasets like KDD CUP99 [37] and NSLKDD [38] but also on the new intrusion detection datasets such as UNSW-NB15 [39], CIC IDS2017 [40]…”
MethodA Hybrid parallel deep learning model for efficient intrusion detection based on metric learning
Cai, S., Han, D., Yin, X., Li, D., & Chang, C. (2022) · Connection Science · doi:10.1080/09540091.2021.2024509 · Cited by 41
Catillo, M., Vecchio, A. D., Pecchia, A., & Villano, U. (2022) · Software Quality Journal · doi:10.1007/s11219-022-09587-0 · Cited by 45
“In order to create the dataset, the proposing group used a laboratory environment with attacker and victim networks Sharafaldin et al. (2018).”
BackgroundMethodInfluentialAPT-Attack Detection Based on Multi-Stage Autoencoders
Neuschmied, H., Winter, M., Stojanović, B., et al. (2022) · Applied Sciences · doi:10.3390/app12136816 · Cited by 39
“In general, this dataset can be considered as a benchmark dataset in the domain of intrusion detection [32].”
BackgroundBelal, M. M., & Sundaram, D. M. (2022) · Journal of King Saud University - Computer and Information Sciences · doi:10.1016/j.jksuci.2022.08.035 · Cited by 55
Malicious traffic detection combined deep neural network with hierarchical attention mechanism
Liu, X., & Liu, J. (2021) · Scientific Reports · doi:10.1038/s41598-021-91805-z · Cited by 38
An Attention-Based Convolutional Neural Network for Intrusion Detection Model
Wang, Z., & Ghaleb, F. A. A. (2023) · IEEE Access · doi:10.1109/access.2023.3271408 · Cited by 49
“Five types of data were extracted from the CSE-CIC-IDS2018 [42] dataset, namely Botnet (1.8%), Infiltration (1.0%), DoS (4.1%), DDoS (8.0”
MethodInfluentialIntrusion Detection using hybridized Meta-heuristic techniques with Weighted XGBoost Classifier
Mohi-ud-din, G., Zhijun, L., Zheng, J., et al. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.120596 · Cited by 38
Chua, T.-H., & Salam, I. (2023) · Symmetry · doi:10.3390/sym15061251 · Cited by 79
Federated learning-based intrusion detection system for Internet of Things
Hamdi, N. (2023) · International Journal of Information Security · doi:10.1007/s10207-023-00727-6 · Cited by 45
“• Weconduct experiments using a real-world dataset (CSECIC-IDS2018 dataset [26]) to evaluate the effectiveness of the proposed intrusion detection model.”
MethodInfluentialYuan, Q., Gou, G., Zhu, Y., Zhu, Y., Xiong, G., & Wang, Y. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3318962 · Cited by 41
“2) Public Datasets: We also verified the effectiveness of MCRe on the CICIDS-2017 [36] intrusion detection dataset.”
MethodIntrusion Detection for Unmanned Aerial Vehicles Security: A Tiny Machine Learning Model
Wu, Y., Yang, L., Zhang, L., Nie, L., & Zheng, L. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3360231 · Cited by 39
“For the CSE-CIC-IDS2018 and CIC-DDOS2019, the optimal feature sets obtained after FS are presented in Tables VI and VII, where the specific meaning of each feature is referenced in [38].”
MethodAloraini, F., Javed, A., & RANA, O. F. (2024) · Sensors · doi:10.3390/s24123848 · Cited by 50
“For example, state-of-the-art IDS datasets, such as CICIDS [39], include more than 80 features, far exceeding the 10 features typically extracted from the CAN frame.”
BackgroundTawfik, M. (2024) · PLoS ONE · doi:10.1371/journal.pone.0304082 · Cited by 38
“Conventional shallow ML models, such as SVM, DT, RF, Naive Bayes classifiers, and ensemble methods, have undergone thorough evaluation on benchmark IDS datasets, such as UNSW-NB15 and NSL-KDD [1, 28, 29].”
BackgroundMethodKamal, H., & Mashaly, M. E. (2025) · Algorithms · doi:10.3390/a18020069 · Cited by 38
Zachos, G., Μαντάς, Γ., Porfyrakis, K., Bastos, J., & Rodrı́guez, J. (2025) · IEEE Access · doi:10.1109/access.2025.3547572 · Cited by 49
A novel federated learning-based IDS for enhancing UAVs privacy and security
Ceviz, Ö., Sadioglu, P., Şen, S., & Vassilakis, V. G. (2025) · Internet of Things · doi:10.1016/j.iot.2025.101592 · Cited by 55
Attack Detection in Enterprise Networks by Machine Learning Methods
Bakhareva, N. F., Shukhman, A., Matveev, A., et al. (2019) · International Russian Automation Conference (RusAutoCon) · doi:10.1109/rusautocon.2019.8867696 · Cited by 38
“As part of this study, the network traffic classifiers were trained on the labeled Intrusion Detection Evaluation Dataset (CICIDS2017) [18].”
MethodDaga, H., Nicholson, P. K., Gavrilovska, A., & Lugones, D. F. (2019) · ACM Symposium on Cloud Computing (SoCC) · doi:10.1145/3357223.3362708 · Cited by 36
“We also evaluate Cartel with a second use case based on network monitoring and intrusion detection (Section 6.4) that uses the CICIDS2017 Intrusion Detection evaluation dataset [59].”
MethodInfluentialUnknown Network Attack Detection Based on Open Set Recognition
Zhang, Y., Niu, J., Guo, D. Z., et al. (2020) · Procedia Computer Science · doi:10.1016/j.procs.2020.06.104 · Cited by 38
Unknown Security Attack Detection Using Shallow and Deep ANN Classifiers
Al‐Zewairi, M., Almajali, S., & Ayyash, M. (2020) · Electronics · doi:10.3390/electronics9122006 · Cited by 39
“CIC-IDS-2017 [42] 2017 Y N Label 2,830,743 Benign Botnet Brute Force DDoS DoS Heartbleed Infiltration Port Scan Web Brute Force: FTP, SSH DoS: GoldenEye, Hulk, SlowHTTPTest, Slowloris Web: Web Brute Force, SQL Injection, XSS 19.”
BackgroundInfluentialSecurity Hardening of Botnet Detectors Using Generative Adversarial Networks
Randhawa, R. H., Aslam, N., Alauthman, M., Rafiq, H., & Comeau, F. (2021) · IEEE Access · doi:10.1109/access.2021.3083421 · Cited by 39
“Although previously used for Tor traffic characterization [39] and data set generation for CIC-IDS2017 and CIC-IDS2018 [16], these extended sets of features can improve the detection of the network anomaly in case of botnet detection as well [27].”
BackgroundMethodInfluentialMulti-layer perceptron for network intrusion detection
Rosay, A., Riou, K., Carlier, F., & Leroux, P. (2021) · Annals of Telecommunications · doi:10.1007/s12243-021-00852-0 · Cited by 40
“With the release of CIC-IDS2017, Sharafaldin et al. [48] provided intrusion detection performance on their data set.”
BackgroundMethodKanimozhi, V., & Jacob, T. P. (2019) · International Journal of Engineering Applied Sciences and Technology · doi:10.33564/ijeast.2019.v04i06.036 · Cited by 38
“The dataset incorporates the catches organize traffic and framework logs of each machine, alongside 80 highlights removed from the caught traffic utilizing CICFlowMeter-V3 [1].”
MethodUNR-IDD: Intrusion Detection Dataset using Network Port Statistics
Das, T., Hamdan, O. A., Shukla, R. M., et al. (2023) · IEEE Consumer Communications & Networking Conference (CCNC) · doi:10.1109/ccnc51644.2023.10059640 · Cited by 38
“The usage of machine learning (ML) for Network Intrusion Detection Systems (NIDS) has gained traction in the last decade as various open-sourced datasets have been established [1] [2] [3].”
BackgroundA Novel Lightweight IoT Intrusion Detection Model Based on Self-Knowledge Distillation
Wang, Z., Zhou, R., Yang, S., He, D., & Chan, S. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3533092 · Cited by 38
“…of the TBCLNN model for intrusion detection in IoT security by conducting intrusion detection experiments on the IoT benchmark datasets CIC-IDS2017 [30], TON_IoT [31], and BOT_IoT [32], as well as dividing the dataset into 80% for training data and 20% for test data, where in the training data are…”
A Systematic Review of Data-Driven Attack Detection Trends in IoT
Haque, S., El-Moussa, F., Komninos, N., & Muttukrishnan, R. (2023) · Sensors · doi:10.3390/s23167191 · Cited by 38
A Review on Application of GANs in Cybersecurity Domain
Arora, A., & Shantanu, S. (2020) · IETE Technical Review · doi:10.1080/02564602.2020.1854058 · Cited by 38
Data Curation and Quality Evaluation for Machine Learning-Based Cyber Intrusion Detection
Tran, N., Chen, H., Bhuyan, J. N., & Ding, J. (2022) · IEEE Access · doi:10.1109/access.2022.3211313 · Cited by 45
Javeed, D., Gao, T., Saeed, M. S., & Khan, M. T. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3288563 · Cited by 37
“The designed framework is trained and evaluated on two IoT-based, publicly available datasets, i.e., CICIDS2017 [31] and N-BaIoT [32].”
MethodERENO: A Framework for Generating Realistic IEC–61850 Intrusion Detection Datasets for Smart Grids
Quincozes, S. E., Albuquerque, C. V. N., Passos, D. G., et al. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3336857 · Cited by 37
“They include the KDDCup99 [26], NSL-KDD [27], UNSW-NB15 [28], and CICIDS2017 [29].”
Zero-Trust Marine Cyberdefense for IoT-Based Communications: An Explainable Approach
Nkoro, E. C., Njoku, J. N., Nwakanma, C. I., Lee, J., & Kim, D. (2024) · Electronics · doi:10.3390/electronics13020276 · Cited by 50
“Using the NSL KDD dataset [41] and the CICIDS 2018 dataset [38], their explanations using SHAP yielded insights towards the significant impact of training features in terms of the proposed NIDS model classification accuracy.”
Applying Generative Machine Learning to Intrusion Detection: A Systematic Mapping Study and Review
Halvorsen, J., Izurieta, C. I., Cai, H., & Gebremedhin, A. H. (2024) · ACM Computing Surveys · doi:10.1145/3659575 · Cited by 41
“Many existing datasets are upward of a decade old or more [92] and thus cannot reflect the current state of malware, which is constantly evolving.”
BackgroundUAV-NIDD: A Dynamic Dataset for Cybersecurity and Intrusion Detection in UAV Networks
Hadi, H. J., Cao, Y., Khan, M. K., et al. (2025) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2025.3553442 · Cited by 37
Contemporary Sequential Network Attacks Prediction using Hidden Markov Model
Chadza, T., Kyriakopoulos, K. G., & Lambotharan, S. (2019) · International Conference on Privacy, Security and Trust (PST) · doi:10.1109/pst47121.2019.8949035 · Cited by 37
“Currently, an Intrusion Detection System (IDS) remains a mandatory line of defence and is crucial in protecting critical networks from intrusions [1].”
BackgroundMethodHierarchical Machine Learning for IoT Anomaly Detection in SDN
Amangele, P., Reed, M. J., Al-Naday, M., et al. (2019) · International Conference on Information Technologies (InfoTech) · doi:10.1109/infotech.2019.8860878 · Cited by 37
“The classifier selection was carried out using the CICIDS2017 dataset which is specifically for network security and intrusion detection testing [9].”
BackgroundMethodAtefi, K., Hashim, H., & Kassim, M. B. (2019) · IEEE Conference on Systems, Process and Control · doi:10.1109/icspc47137.2019.9068081 · Cited by 37
“The references, [18][21][22], proposed that IDSs are the most important instruments of protection against advanced and growing attacks on the network.”
BackgroundMethodIntrusion Traffic Detection and Characterization using Deep Image Learning
Kaur, G., Lashkari, A. H., & Rahali, A. (2020) · IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech) · doi:10.1109/dasc-picom-cbdcom-cyberscitech49142.2020.00025 · Cited by 38
Self-citationA Generalized Machine Learning Based Model for the Detection of DDoS Attacks
Marvi, M., Arfeen, A., & Uddin, R. (2020) · International Journal of Network Management · doi:10.1002/nem.2152 · Cited by 39
“23 The offered performance is comparable to the state-of-the-art DL-based model published by using the same dataset.”
MethodFeature selection for intrusion detection systems
Kamalov, F., Moussa, S., Zgheib, R., et al. (2020) · International Symposium on Computational Intelligence and Design · doi:10.1109/iscid51228.2020.00065 · Cited by 37
“The dataset used in our experiment is obtained from the collaborative project between the Communications Security Establishment and the Canadian Institute for Cy-bersecurity [14].”
MethodPractical Intrusion Detection of Emerging Threats
Mills, R., Marnerides, A. K., Broadbent, M., & Race, N. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3091517 · Cited by 40
“The KDD ’99 data set is one of the first publicly available IDS data sets and remains the most widely adopted in the evaluation of anomaly detection methods [16].”
BackgroundMethodRANet: Network intrusion detection with group-gating convolutional neural network
Zhang, X., Yang, F., Hu, Y., Zhao, T. Q., Liu, W., Yi-fa, L., & She, W. (2021) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2021.103266 · Cited by 38
Cyber threat prediction using dynamic heterogeneous graph learning
Zhao, J., Shao, M., Wang, H., Yu, X., Li, B. H., & Liu, X. (2022) · Knowledge-Based Systems · doi:10.1016/j.knosys.2021.108086 · Cited by 39
GraphDDoS: Effective DDoS Attack Detection Using Graph Neural Networks
Li, Y., Li, R., Zhou, Z., Jiang, G., Yang, W., Du, M., & Liu, Q. (2022) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd54268.2022.9776097 · Cited by 40
“1) Dataset: We use two well-known datasets, CICIDS2017 1 [13] and CIC-DoS2017 2 [14].”
CNN-IDS: Convolutional Neural Network for Network Intrusion Detection System
Halbouni, A. H., Gunawan, T. S., Halbouni, M., Assaig, F. A., Effendi, M. R., & Ismail, N. (2022) · International Conference on Wireless and Telematics (ICWT) · doi:10.1109/icwt55831.2022.9935478 · Cited by 37
“In addition to regular records, this dataset contains 11 types of attacks [11-13].”
BackgroundImanbayev, A., Tynymbayev, S., Одарченко, Р. С., Gnatyuk, S. O., Berdibayev, R., Байкенов, А., & Kaniyeva, N. (2022) · Sensors · doi:10.3390/s22249957 · Cited by 40
“Datasets such as CICIDS2017 Datasets such as CICIDS2017 [65] and CSE-CIC-IDS2018 [66] have been considered in this study. this study.”
MethodInfluentialAn Efficient Two-Stage Network Intrusion Detection System in the Internet of Things
Zhang, H., Zhang, B., Huang, L., Zhang, Z., & Huang, H. (2023) · Information · doi:10.3390/info14020077 · Cited by 45
Prasad, A., & Chandra, S. (2023) · Arabian Journal for Science and Engineering · doi:10.1007/s13369-023-08016-z · Cited by 36
Nature-inspired intrusion detection system for protecting software-defined networks controller
Kumar, C., Biswas, S., Ansari, M. S. A., et al. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103438 · Cited by 36
Enabling 6G Security: The Synergy of Zero Trust Architecture and Artificial Intelligence
Sedjelmaci, H., Tourki, K., & Ansari, N. (2023) · IEEE Network · doi:10.1109/mnet.2023.3326003 · Cited by 36
DeepDefend: A comprehensive framework for DDoS attack detection and prevention in cloud computing
Ouhssini, M., Afdel, K., Agherrabi, E., et al. (2024) · Journal of King Saud University - Computer and Information Sciences · doi:10.1016/j.jksuci.2024.101938 · Cited by 36
“In the existing body of literature, two datasets, namely CIDDS-001 (Ring et al., 2017) and CIC-IDS-2018 (Sharafaldin et al., 2018), which were generated in a cloud environment, have gained significant consideration.”
ProGen: Projection-Based Adversarial Attack Generation Against Network Intrusion Detection
Wang, M., Yang, N., Forcade-Perkins, N. J., & Weng, N. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3402155 · Cited by 38
“1) Dataset: In this paper, we utilize the tabular data and raw Pcaps of 3 datasets (UNSW-NB15 [36], CIC-IDS-2017 (corrected) [27], [37], and CSE-CIC-IDS2018 [27]) to evaluate the proposed ProGen method.”
MethodFTG-Net-E: A hierarchical ensemble graph neural network for DDoS attack detection
Bakar, R. A., Marinis, L. D., Cugini, F., et al. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110508 · Cited by 36
Integrating large language models with internet of things: applications
Zong, M., Hekmati, A., Guastalla, M., Li, Y., & Krishnamachari, B. (2025) · Discover Internet of Things · doi:10.1007/s43926-024-00083-4 · Cited by 54
“5, GPT-4, and Ada models on the CICIDS 2017 dataset [6].”
A DDoS attack detection method based on IQR and DFFCNN in SDN
Yue, M., Yan, H., Han, R., & Wu, Z. (2025) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2025.104203 · Cited by 37
Anomaly Based Unknown Intrusion Detection in Endpoint Environments
Kim, S., Hwang, C., & Lee, T. (2020) · Electronics · doi:10.3390/electronics9061022 · Cited by 36
Detection of Denial of Service Attacks in Communication Networks
Rios, A. L. G., Li, Z., Bekshentayeva, K., & Trajković, L. (2020) · IEEE International Symposium on Circuits and Systems proceedings · doi:10.1109/iscas45731.2020.9180445 · Cited by 38
A Comparative Study on Contemporary Intrusion Detection Datasets for Machine Learning Research
Dwibedi, S., Pujari, M., & Sun, W. (2020) · IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi49825.2020.9280519 · Cited by 36
“Nevertheless, it has been used in the evaluation of alert correlation mechanisms [4].”
Method
Metadata
- Authors
- Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A.
- Affiliations
- University of New Brunswick (CA)
- University of New Brunswick (UNB), Canada
- Venue
- Proceedings of the 4th International Conference on Information Systems Security and Privacy
- Published
- 2018
- Pages
- 108-116
- OpenAlex
- W2789828921
- Cited by
- 5,318
- References
- 27
- Citations by year
- 2026: 1170 · 2025: 1032 · 2024: 803 · 2023: 704 · 2022: 558 · 2021: 518 · 2020: 332 · 2019: 165 · 2018: 35
- FWCI
- 215.46
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- cc-by-nc-nd
- Locations
- International Conference on Information Systems Security and Privacy (ICISSP) (publishedVersion, cc-by-nc-nd)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- intrusion detection, intrusion detection datasets, network traffic characterization, network security, dataset construction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
