The DOI matches its Crossref record; 20 of the 27 references it cites were found in a registry or an index.
Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization
Open accessOverview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Many studies classify feature selection methods into three categories: filter-based techniques, wrapper techniques, and embed techniques”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [210]
Citations
Cites
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396 · cited 3×
“KDD’99 (University of California, Irvine 1998-99): This dataset is an updated version of the DARPA98, by processing the tcpdump portion.”
BackgroundMethodSelf-citationTesting Intrusion detection systems
McHugh, J. (2000) · ACM Transactions on Privacy and Security · doi:10.1145/382912.382923 · Cited by 1,490 · cited 4×
“Moreover, it lacks actual attack data records (McHugh, 2000) (Brown et al.”
BackgroundMethodInfluentialToward developing a systematic approach to generate benchmark datasets for intrusion detection
Shiravi, A., Shiravi, H., Tavallaee, M., & Ghorbani, A. A. (2012) · Computers & Security · doi:10.1016/j.cose.2011.12.012 · Cited by 1,345
Self-citationCharacterization of Tor Traffic using Time based Features
Lashkari, A. H., Gil, G. D., Mamun, M., & Ghorbani, A. A. (2017) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0006105602530262 · Cited by 926 · cited 3×
“We begin to extract the 80 traffic features from the dataset using CICFlowMeter (CICFlowMeter, 2017),(Habibi Lashkari et al., 2017).”
MethodSelf-citationStatistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation
Song, J., Takakura, H., Okabe, Y., Eto, M., Inoue, D., & Nakao, K. (2011) · International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security · doi:10.1145/1978672.1978676 · Cited by 335 · cited 2×
“The normal traffic here has been simulated repeatedly during the attacks and producing only DNS and mail traffic data, which is not reflected in real world normal network traffic, so there are no false positives, which are important for minimizing the number of alerts (Song et al., 2011) (M.”
BackgroundGeneration of a new IDS test dataset: Time to retire the KDD collection
Creech, G., & Hu, J.-K. (2013) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc.2013.6555301 · Cited by 326 · cited 1×
“ADFA (University of New South Wales 2013): This dataset includes normal training and validating data and 10 attacks per vector (Creech and Hu, 2013).”
MethodTowards a Reliable Intrusion Detection Benchmark Dataset
Sharafaldin, I., Gharib, A., Lashkari, A. H., & Ghorbani, A. A. (2017) · Software Networking · doi:10.13052/jsn2445-9739.2017.009 · Cited by 309 · cited 9×
“Finally, we evaluate the quality of the generated dataset by searching for common mistakes and criticisms of other synthetically created datasets, based on the 11 criteria from the last proposed dataset evaluation framework by Canadian Institute for Cybersecurity (CIC)(Sharafaldin et al., 2017).”
MethodInfluentialSelf-citationAn Evaluation Framework for Intrusion Detection Dataset
Gharib, A., Sharafaldin, I., Lashkari, A. H., et al. (2016) · International Conferences on Information Science and System · doi:10.1109/icissec.2016.7885840 · Cited by 224 · cited 6×
“Regarding to the last dataset evaluation framework published on 2016 (Gharib et al., 2016), covering eleven criteria is necessary for each dataset.”
BackgroundMethodInfluentialSelf-citationNetwork Intrusion Detection and Prevention - Concepts and Techniques
Ghorbani, A., Lu, W., & Tavallaee, M. (2009) · Advances in Information Security · doi:10.1007/978-0-387-88771-5 · Cited by 175 · cited 1×
“Since 1999, Scott et al. (Scott and Wilkins, 1999), Heideman and Papadopulus (Heidemann and Papdopoulos, 2009), Ghorbani et al. (Ghorbani Ali and Mahbod, 2010), Nehinbe (Nehinbe, 2011), Shiravi et al. (Ali Shiravi and Ghorbani, 2012), and Sharfaldin et al. (Gharib et al., 2016) tried to propose an…”
BackgroundSelf-citationA Labeled Data Set for Flow-Based Intrusion Detection
Sperotto, A., Sadre, R., van Vliet, F., & Pras, A. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04968-2_4 · Cited by 155 · cited 1×
“It is labelled and is more realistic, but the lack of volume and diversity of attacks is obvious (Sperotto et al., 2009).”
Background
Cited by
Sorted by citations
Items 701–800 of 1,010
Balancing Approaches towards ML for IDS: A Survey for the CSE-CIC IDS Dataset
Gopalan, S. S., Ravikumar, D., Linekar, D., Raza, A., & Hasib, M. (2021) · International Conference on Communications, Signal Processing, and their Applications (ICCSPA) · doi:10.1109/iccspa49915.2021.9385742 · Cited by 38
Evaluating ML-based DDoS Detection with Grid Search Hyperparameter Optimization
Sanchez, O. R., Repetto, M., Carrega, A., & Bolla, R. (2021) · IEEE International Conference on Network Softwarization (NetSoft) · doi:10.1109/netsoft51509.2021.9492633 · Cited by 37
“05% of F1-measure in the evaluation using CIC-IDS (2017) [15].”
MethodNetwork intrusion detection system: machine learning approach
Jaradat, A. S., Barhoush, M. M., & Easa, R. S. B. (2022) · Indonesian Journal of Electrical Engineering and Computer Science · doi:10.11591/ijeecs.v25.i2.pp1151-1158 · Cited by 44
Early Detection of Network Attacks Using Deep Learning
Ahmad, T., Truşcan, D., Vain, J., & Porres, I. (2022) · IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW) · doi:10.1109/icstw55395.2022.00020 · Cited by 45
“5) We empirically evaluate our approach using the CICIDS2017 [9] dataset.”
BackgroundMethodInfluentialBaldini, G., & Amerini, I. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.108923 · Cited by 36
Optimized Deep Learning with Binary PSO for Intrusion Detection on CSE-CIC-IDS2018 Dataset
Farhan, R. I., Maolood, A. T., & Hassan, N. F. (2020) · Journal of Al-Qadisiyah for Computer Science and Mathematics · doi:10.29304/jqcm.2020.12.3.706 · Cited by 39
“According to Gharib et al. [18], determined 11 essential criteria for each dataset to be reliable dataset, but none of previous NIDS dataset covered all criteria.”
BoAu: Malicious traffic detection with noise labels based on boundary augmentation
Yuan, Q., Liu, C., Yu, W., Zhu, Y., Xiong, G., Wang, Y., & Gou, G. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103300 · Cited by 36
Anomaly detection in streaming data: A comparison and evaluation study
Iglesias, F., Hartl, A., Zseby, T., & Zimek, A. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.120994 · Cited by 35
Metamorphic Malware and Obfuscation: A Survey of Techniques, Variants, and Generation Kits
Brezinski, K., & Ferens, K. (2023) · Security and Communication Networks · doi:10.1155/2023/8227751 · Cited by 45
“Other lesser known network datasets include CAIDA [96] and ISCX 2012 [97] for network intrusion detection and CICIDS2017 [98].”
BackgroundMethodRoshan, K., & Zafar, A. (2024) · International Journal of Information Technology · doi:10.1007/s41870-024-01727-y · Cited by 35
“The three benchmark cyber security datasets, namely, CIC-IDS-2017 [34], CIC-IoT-2023 [35] and CIC-MalMem-2022 The third dataset is CIC-MalMem-2022, widely used for cyber attacks and malware detection.”
Overview of DDoS Attack Detection in Software-Defined Networks
Wang, H., & Li, Y. (2024) · IEEE Access · doi:10.1109/access.2024.3375395 · Cited by 35
“Violent FTP, violent SSH, DoS, Heartbleed, Web attack, penetration, Botnet, DDoS, etc. CICFlowMeter is used to extract 80 features from the generated network traffic, which is similar to the real traffic in the real world [14].”
MethodDeep-Learning-Based Approach for IoT Attack and Malware Detection
Taşçı, B. (2024) · Applied Sciences · doi:10.3390/app14188505 · Cited by 35
“The CIC-IDS2017 dataset, created by the Canadian Institute for Cybersecurity in 2017, is a comprehensive and up-to-date dataset for cybersecurity research [34].”
MethodCybersecurity in the AI era: analyzing the impact of machine learning on intrusion detection
Dong, H., & Kotenko, I. V. (2025) · Knowledge and Information Systems · doi:10.1007/s10115-025-02366-w · Cited by 46
Enhancing Robustness Against Adversarial Examples in Network Intrusion Detection Systems
Hashemi, M., & Keller, E. R. (2020) · IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN) · doi:10.1109/nfv-sdn50289.2020.9289869 · Cited by 45
“To evaluate our approach, we used a highly cited dataset containing network traces of twelve network attacks from the Canadian Institute of Cybersecurity (CIC) 2 [24].”
MethodHybrid intrusion detection system based on Dempster-Shafer evidence theory
Weicheng, Q., Yinghua, M., Chen, X., Yu, H., & Chen, L. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102709 · Cited by 34
Wichtlhuber, M., Strehle, E., Kopp, D., et al. (2022) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/3544216.3544268 · Cited by 35
A Hybrid CNN-LSTM Model for IIoT Edge Privacy-Aware Intrusion Detection
de Elias, E. M., Carriel, V. S., de Oliveira, G. W., et al. (2022) · IEEE Latin-American Conference on Communications · doi:10.1109/latincom56090.2022.10000468 · Cited by 34
“Year IIoT CICIDS2017 [10] 2017 No MQTT-IOT-IDS2020 [11] 2020 Yes MQTTset [12] 2020 No WUSTL-IIoT-2021 [13] 2021 Yes X-IIoTID [14] 2021 Yes Edge-IIoTset [6] 2022 Yes Nonetheless, the scope of this study is not to create, compound, or treat datasets as other works like [15], which combine different…”
BackgroundMukhaini, G. A., Anbar, M., Manickam, S., Al-Amiedy, T. A., & Momani, A. A. (2023) · Journal of King Saud University - Computer and Information Sciences · doi:10.1016/j.jksuci.2023.101866 · Cited by 42
“CICIDS2017 was proposed by (Sharafaldin et al., 2018).”
Introducing packet-level analysis in programmable data planes to advance Network Intrusion Detection
Doriguzzi-Corin, R., Knob, L. A. D., Mendozzi, L., Siracusa, D., & Savi, M. (2023) · Computer Networks · doi:10.1016/j.comnet.2023.110162 · Cited by 41
An Approach for Optimizing Ensemble Intrusion Detection Systems
Stiawan, D., Heryanto, A., Bardadi, A., et al. (2020) · IEEE Access · doi:10.1109/access.2020.3046246 · Cited by 34
“Results in Table 3 show that ITD-UTM and CICIDS-2017 datasets [39] have attack varieties close to the real traffic, means that the dataset represent well the real traffic, in term of complexity of the attacks.”
BackgroundSSH-Brute Force Attack Detection Model based on Deep Learning
Wanjau, S. K., Wambugu, G. M., & Kamau, G. N. (2021) · International Journal of Computer Applications Technology and Research · doi:10.7753/ijcatr1001.1008 · Cited by 39
“The study evaluated the models using two recent network intrusion detection datasets with known ground truth of malicious versus benign traffic, the CIC IDS 2017 dataset [33] and ISCX IDS 2012 [34] dataset.”
MethodImproving Data Generalization With Variational Autoencoders for Network Traffic Anomaly Detection
Monshizadeh, M., Khatri, V., Gamdou, M., Kantola, R., & Yan, Z. (2021) · IEEE Access · doi:10.1109/access.2021.3072126 · Cited by 35
“Dataset includes normal and malicious traffic [21]–[23].”
MethodCollaborative detection and mitigation of DDoS in software-defined networks
Tayfour, O. E., & Marsono, M. N. (2021) · The Journal of Supercomputing · doi:10.1007/s11227-021-03782-9 · Cited by 34
“packet Len Std, Flow Duration, Avg Packet Size, and IAT Std, has been selected to Detect the DDoS attack as listed in [19, 30].”
MethodPustokhina, I. V., Pustokhin, D. A., Lydia, E. L., et al. (2021) · Multimedia Tools and Applications · doi:10.1007/s11042-021-11271-7 · Cited by 34
“Sharafaldin et al. [23] generated a stable CICIDS2017 dataset with 7 typical attack network flows.”
BackgroundPredictive machine learning-based integrated approach for DDoS detection and prevention
Kebede, S. D., Tiwari, B., Tiwari, V., et al. (2021) · Multimedia Tools and Applications · doi:10.1007/s11042-021-11740-z · Cited by 34
“Thus, the Intrusion Detection System (IDS) has been acquainted as a safety component to identify several attacks [24, 26].”
BackgroundTemporal Weighted Averaging for Asynchronous Federated Intrusion Detection Systems
Agrawal, S., Chowdhuri, A., Sarkar, S., Selvanambi, R., & Gadekallu, T. R. (2021) · Computational Intelligence and Neuroscience · doi:10.1155/2021/5844728 · Cited by 34
“e variety in architectures comes from the different datasets that are available for the training of IDS: NSLKDD dataset [8], CICIDS dataset [9], Bot-IoT dataset [10], etc.”
BackgroundShieldRNN: A Distributed Flow-Based DDoS Detection Solution for IoT Using Sequence Majority Voting
Alasmary, F., Alraddadi, S., Al-Ahmadi, S. A., et al. (2022) · IEEE Access · doi:10.1109/access.2022.3200477 · Cited by 34
“The values of true negatives (TN), false positives (FP), false negatives (FN), and true positives (TP) when we evaluated our models on the testing set of CIC-IDS2017 - Friday [26].”
MethodInfluentialAgrafiotis, G., Makri, E., Flionis, I., et al. (2022) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3538969.3544473 · Cited by 34
“The CIC-IDS2017 dataset [21] contains captured traffic of benign packets and common attacks, more specifically real-world data over a period of 5 days”
BackgroundDoS and DDoS mitigation using Variational Autoencoders
Bårli, E. M., Yazidi, A., Herrera‐Viedma, E., et al. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108399 · Cited by 33
“For the full network setup of the CICIDS2017 dataset, see [52].”
MethodHe, J., Wang, X., Song, Y., et al. (2023) · Neurocomputing · doi:10.1016/j.neucom.2023.01.072 · Cited by 33
Graph-ensemble fusion for enhanced IoT intrusion detection: leveraging GCN and deep learning
Mittal, K., & Batra, P. K. (2024) · Cluster Computing · doi:10.1007/s10586-024-04404-8 · Cited by 34
“In 2018, a dataset was made available through a collaborative effort between the Communications Security Establishment (CSE) and the Canadian Institute for Cybersecurity (CIC) [44].”
Correlation-Aware Neural Networks for DDoS Attack Detection in IoT Systems
Hekmati, A., Zhang, J., Sarkar, T., Jethwa, N., Grippo, E., & Krishnamachari, B. (2024) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2024.3408675 · Cited by 49
“Furthermore, Sharafaldin et al. [16] presented a DDoS dataset and also an ML-based technique for detecting DDoS attacks.”
MethodAceto, G., Giampaolo, F., Guida, C., Izzo, S., Pescapè, A., Piccialli, F., & Prezioso, E. (2024) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2024.103926 · Cited by 37
VAE-WACGAN: An Improved Data Augmentation Method Based on VAEGAN for Intrusion Detection
Tian, W., Shen, Y., Guo, N., Yuan, J., & Yang, Y. (2024) · Sensors · doi:10.3390/s24186035 · Cited by 38
“The experimental validation utilized two datasets commonly used in the field of intrusion detection: UNSW-NB15 [37] and CIC-IDS2017 [9].”
MethodCyberAIBot: Artificial Intelligence in an intrusion detection system for CyberSecurity in the IoT
Serrano, W. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.107543 · Cited by 39
Popli, M. S., Singh, R. P., Popli, N. K., & Mamun, M. (2025) · IEEE Access · doi:10.1109/access.2025.3530499 · Cited by 36
HiViT-IDS: An Efficient Network Intrusion Detection Method Based on Vision Transformer
Zhou, H., Zou, H., Li, W., Li, D., & Kuang, Y. (2025) · Sensors · doi:10.3390/s25061752 · Cited by 37
“However, this method is exceptionally time-intensive, requiring 36,366 s of training on the CIC-IDS-2017 dataset [18], which challenges its applicability in rapidly shifting threat landscapes.”
InfluentialIoT or NoT: Identifying IoT Devices in a Short Time Scale
Bremler-Barr, A., Levy, H., & Yakhini, Z. (2020) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms47738.2020.9110451 · Cited by 33
“We note that the NoT devices from [32] were configured with a static IP, and thus the technique cannot be applied to them.”
BackgroundMethodFeature selection using principal component analysis and genetic algorithm
Adhao, R. B., & Pachghare, V. (2020) · Journal of Discrete Mathematical Sciences and Cryptography · doi:10.1080/09720529.2020.1729507 · Cited by 36
“Many datasets are available for evaluating effectiveness of intrusion detection systems, but dataset developed by the Canadian Institute of Cyber Security CICIDS2017 not only contains up-to-date attacks but also fulfills all the criterion of real world attack [11].”
BackgroundSiddiqui, A. J., & Boukerche, A. (2020) · Cluster Computing · doi:10.1007/s10586-020-03153-8 · Cited by 33
“With the CICIDS2017 datasets, we conduct two sets of experiments.”
BackgroundMethodResultInfluentialEdge-Detect: Edge-Centric Network Intrusion Detection using Deep Neural Network
Singh, P., Jaykumar, J., Pankaj, A., et al. (2021) · IEEE Consumer Communications & Networking Conference (CCNC) · doi:10.1109/ccnc49032.2021.9369469 · Cited by 33
“They have applied their model on the CICIDS2017 [21] dataset, achieving an accuracy of about 90%.”
On the Performance of GRASP-Based Feature Selection for CPS Intrusion Detection
Quincozes, S. E., Mossé, D., Passos, D. G., Albuquerque, C. V. N., Ochi, L. S., & dos Santos, V. F. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3088763 · Cited by 33
Rehman, E., Haseeb-ud-Din, M., Malik, A. J., Khan, T. K., Abbasi, A. A., Kadry, S., Khan, M. A., & Rho, S. (2022) · The Journal of Supercomputing · doi:10.1007/s11227-021-04188-3 · Cited by 34
“It has insufficient classification procedures, and no additional attributes were made [184].”
BackgroundRetractedSoK: The Impact of Unlabelled Data in Cyberthreat Detection
Apruzzese, G., Laskov, P., & Tastemirova, A. (2022) · European Symposium on Security and Privacy · doi:10.1109/eurosp53844.2022.00010 · Cited by 53
Hybrid Strategy Improved Sparrow Search Algorithm in the Field of Intrusion Detection
Liu, T., & Xueqiang, M. (2023) · IEEE Access · doi:10.1109/access.2023.3259548 · Cited by 33
“A. DATA PREPROCESSING CIC-IDS2017 dataset is a network intrusion detection dataset designed, collected and processed by Sharafaldin et al. [34].”
MethodDeepWindow: An Efficient Method for Online Network Traffic Anomaly Detection
Shi, Z., Li, J., Wu, C., et al. (2019) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc/smartcity/dss.2019.00335 · Cited by 33
“CICIDS2017 dataset [22] contains benign and the most upto-date common attacks, which resembles the true real-world data (PCAPs).”
BackgroundZhang, T., Xu, C., Zhang, B., Li, X., Kuang, X., & Grieco, L. A. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3237604 · Cited by 32
Hierarchical LSTM-Based Network Intrusion Detection System Using Hybrid Classification
Han, J., & Pak, W. (2023) · Applied Sciences · doi:10.3390/app13053089 · Cited by 39
Moreno, J. F. C., Rizzardi, A., Sicari, S., & Coen‐Porisini, A. (2023) · Computer Networks · doi:10.1016/j.comnet.2023.110016 · Cited by 43
“Another recent work that adopted a similar imitation learning strategy using a DQN agent was presented in [66] where the offline training was done over the CSE-CIC-IDS2018 dataset [67].”
MethodLucas, T. J., de Figueiredo, I. S., Tojeiro, C. A. C., de Almeida, A. M. G., Scherer, R., Brega, J. R. F., Papa, J. P., & da Costa, K. A. P. (2023) · IEEE Access · doi:10.1109/access.2023.3328535 · Cited by 39
“The set of CICIDS-2017 datasets [210], made available by the Canadian Institute for Cybersecurity 5 through the University of New Brunswick 6 is divided into eight files (Table 5), according to Panigrahi and Borah [211] and Stiawan et al. [212].”
MethodDRL-GAN: A Hybrid Approach for Binary and Multiclass Network Intrusion Detection
Strickland, C., Zakar, M., Saha, C., Nejad, S. S., Tasnim, N., Lizotte, D. J., & Haque, A. (2024) · Sensors · doi:10.3390/s24092746 · Cited by 40
“This method was applied to the NSL-KDD, UNSW-NB15 [11], and CICIDS-2017 [21] datasets, resulting in notable improvements in the detection capabilities of ML models.”
MethodContraMTD: An Unsupervised Malicious Network Traffic Detection Method based on Contrastive Learning
Han, X., Cui, S., Qin, J., et al. (2024) · ACM Web Conference (WWW) · doi:10.1145/3589334.3645479 · Cited by 32
Han, D., Li, H., Fu, X., & Zhou, S. (2024) · Sensors · doi:10.3390/s24134344 · Cited by 35
“Since the objective is to identify attacks in SDN networks, three datasets, InSDN [27], CICIDS2017 [28], and CICIDS2018 [28] datasets, are utilized in this paper.”
BackgroundMethodInfluentialMallidi, S. K. R., & Ramisetty, R. R. (2025) · Wiley Interdisciplinary Reviews Data Mining and Knowledge Discovery · doi:10.1002/widm.70008 · Cited by 34
Vellela, S. S., Roja, D., Purimetla, N. R., Syamsundararao, T., Vuyyuru, L. R., & Vatambeti, R. (2025) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2025.110368 · Cited by 33
Wisanwanichthan, T., & Thammawichai, M. (2025) · Computers · doi:10.3390/computers14070291 · Cited by 51
Attentional Payload Anomaly Detector for Web Applications
Qin, Z., Ma, X., & Wang, Y. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-04212-7_52 · Cited by 31
Adversarial Attack against LSTM-based DDoS Intrusion Detection System
Huang, W., Peng, X., Shi, Z., & Ma, Y. (2020) · IEEE International Conference on Tools with Artificial Intelligence (ICTAI) · doi:10.1109/ictai50040.2020.00110 · Cited by 39
“To evaluate the effectiveness of the proposed methods, we use CICIDS2017 dataset [22].”
MethodBotnet traffic identification using neural networks
Biswas, R., & Roy, S. (2021) · Multimedia Tools and Applications · doi:10.1007/s11042-021-10765-8 · Cited by 32
“In contrast, IoT devices were not represented in the testbeds in previous works [1, 19] with the exception [2].”
Toward the Protection of IoT Networks: Introducing the LATAM-DDoS-IoT Dataset
Almaraz-Rivera, J. G., Pérez-Díaz, J. A., Cantoral-Ceballos, J. A., et al. (2022) · IEEE Access · doi:10.1109/access.2022.3211513 · Cited by 32
“This section describes the most commonly used datasets for network forensics and designing protection systems [4], [9].”
BackgroundQuincozes, S. E., Kazienko, J. F., & Quincozes, V. E. (2023) · Internet of Things · doi:10.1016/j.iot.2023.100684 · Cited by 32
SPE-ACGAN: A Resampling Approach for Class Imbalance Problem in Network Intrusion Detection Systems
Yang, H., Xu, J., Xiao, Y., et al. (2023) · Electronics · doi:10.3390/electronics12153323 · Cited by 32
“CICIDS-2017 and CICIDS-2018 [30] are network intrusion detection datasets published by the Canadian Institute for Cybersecurity (CIC) on Amazon Web Services (AWS) in 2017 and 2018.”
BackgroundInfluentialMitigation of Black-Box Attacks on Intrusion Detection Systems-Based ML
Alahmed, S., Alasad, Q., Hammood, M. M., et al. (2022) · Computers · doi:10.3390/computers11070115 · Cited by 31
“Dataset The CSE-CIC-IDS2018 is an intrusion detection dataset created by the Communications Security Establishment and Canadian Institute for Cybersecurity on AWS (Amazon Web Services), located at Fredericton, Canada, in 2018 [46].”
MethodHierarchical Detection of Network Anomalies : A Self-Supervised Learning Approach
Kye, H., Kim, M.-R., & Kwon, M. (2022) · IEEE Signal Processing Letters · doi:10.1109/lsp.2022.3203296 · Cited by 31
“To show that the performance of the solution is not limited to a specific dataset, two popular datasets collected in the LAN networks are used: the NSL-KDD dataset [20] and the CSE-CIC-IDS2018 dataset [21].”
MethodMAP4: A Pragmatic Framework for In-Network Machine Learning Traffic Classification
Xavier, B. M., Guimarães, R. S., Comarela, G. V., et al. (2022) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3212913 · Cited by 31
“For the Heavy work-load, it is possible to observe the minimum difference between CICIDS2017 and UNSW-IoT in the per-packet model.”
BackgroundMethodInfluentialAn IoT Intrusion Detection System Based on TON IoT Network Dataset
Guo, G., Pan, X., Liu, H., Li, F., Pei, L., & Hu, K. (2023) · IEEE Annual Computing and Communication Workshop and Conference (CCWC) · doi:10.1109/ccwc57344.2023.10099144 · Cited by 37
Applying Transfer Learning Approaches for Intrusion Detection in Software-Defined Networking
Chuang, H., & Ye, L.-J. (2023) · Sustainability · doi:10.3390/su15129395 · Cited by 35
Sketch-Based Anomaly Detection in Streaming Graphs
Bhatia, S., Wadhwa, M., Kawaguchi, K., Shah, N., Yu, P. S., & Hooi, B. (2023) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3580305.3599504 · Cited by 43
“Table 3 shows the statistical summary of the four real-world datasets that we use:DARPA [61] and ISCX-IDS2012 [62] are popular datasets for graph anomaly detection used by baselines to evaluate their algorithms; [63] surveys more than 30 datasets and recommends to use the newer CIC-IDS2018 and CIC-DDoS2019 datasets [6…”
MethodReview on intrusion detection system for IoT/IIoT -brief study
Bansal, K., & Singhrova, A. (2023) · Multimedia Tools and Applications · doi:10.1007/s11042-023-16395-6 · Cited by 37
“In this research, the authors employed several sets of features that were gathered in two datasets: CICIDS2017 [63] and NBaIoT [51]; to assess the TempoCode-IoT feature translation approach that was suggested.”
SeNet-I: An approach for detecting network intrusions through serialized network traffic images
Farrukh, Y. A., Wali, S. W., Khan, I., et al. (2023) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.107169 · Cited by 31
Deep Learning for Intrusion Detection Systems (IDSs) in Time Series Data
Psychogyios, K., Papadakis, A. E., Bourou, S., Nikolaou, N., Maniatis, A., & Zahariadis, T. B. (2024) · Future Internet · doi:10.3390/fi16030073 · Cited by 38
Enhancing IoT Security: A Few-Shot Learning Approach for Intrusion Detection
Althiyabi, T., Ahmad, I. A., & Alassafi, M. O. (2024) · Mathematics · doi:10.3390/math12071055 · Cited by 31
“Among the 15 classes, 1 class is normal and the rest are different CIC stands for the Canadian Institute for Cyber Security, while IDS refers to an IDS; the last number, 2017, is the date of release. cyber intrusion attacks, such as botnet, SQL injection, and DDoS attacks.”
BackgroundENIDS: A Deep Learning-Based Ensemble Framework for Network Intrusion Detection Systems
Sayem, I. M., Sayed, M. I., Saha, S., & Haque, A. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3414305 · Cited by 42
“The DL-based NIDS got more attention from the research community when the Canadian Institute of Cybersecurity (CIC) published two large network traffic datasets, namely CICIDS-2017 [14] and CSE-CIC-IDS-2018 [14].”
MethodResultInfluentialA two stage lightweight approach for intrusion detection in Internet of Things
Li, Z., & Yao, W. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.124965 · Cited by 37
Hamad, N. A., Bakar, K. A. A., Qamar, F., Jubair, A. M., Mohamed, R. R., & Mohamed, M. A. (2025) · IEEE Access · doi:10.1109/access.2025.3574672 · Cited by 41
“• In 2018, the Communications Security Establishment (CSE) and the Canadian Institute for Cybersecu-rity (CIC) collaborated to provide the CSE-CIC-IDS2018 dataset [54].”
Multi-Layer Hidden Markov Model Based Intrusion Detection System
Zegeye, W. K., Dean, R. A., & Moazzami, F. (2018) · Machine Learning and Knowledge Extraction · doi:10.3390/make1010017 · Cited by 31
“References 1.”
MethodInfluentialMachine Learning DDoS Detection Using Stochastic Gradient Boosting
Prasad, M.-A., Babu, P., & Amarnath, C. (2019) · International Journal of Computer Sciences and Engineering · doi:10.26438/ijcse/v7i4.157166 · Cited by 31
A Novel Deep Learning Based Intrusion Detection System for Smart Meter Communication Network
Vijayanand, R., Devaraj, D., & Kannapiran, B. (2019) · IEEE International Conference on Intelligent Techniques in Control, Optimization and Signal Processing (INCOS) · doi:10.1109/incos45849.2019.8951344 · Cited by 34
“This section explains the simulation of proposed deep learning based IDS using the standard CICIDS2017 dataset [13].”
MethodCausalConvLSTM: Semi-Supervised Log Anomaly Detection Through Sequence Modeling
Yen, S., Moh, M., & Moh, T.-S. (2019) · IEEE International Conference on Machine Learning and Applications (ICMLA) · doi:10.1109/icmla.2019.00217 · Cited by 31
“The dataset we were able to obtain was the Canadian Institute for Cybersecurity’s Intrusion Detection Evaluation Dataset (CICIDS2017), published by the authors of [11].”
MethodZhao, J., Liu, X., Yan, Q., Li, B., Shao, M., Peng, H. M., & Sun, L. (2020) · Computers & Security · doi:10.1016/j.cose.2020.102152 · Cited by 31
Detecting multi-stage attacks using sequence-to-sequence model
Zhou, P., Zhou, G., Wu, D., & Fei, M. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102203 · Cited by 34
Deep Learning Approach for Detecting Malicious Activities Over Encrypted Secure Channels
Yang, J., & Lim, H. (2021) · IEEE Access · doi:10.1109/access.2021.3064561 · Cited by 34
Machine Learning Classification of Port Scanning and DDoS Attacks: A Comparative Analysis
Aamir, M., Rizvi, S. S. H., Hashmani, M. A., Zubair, M., & Usman, J. A. (2021) · Mehran University Research Journal of Engineering and Technology · doi:10.22581/muet1982.2101.19 · Cited by 37
“The dataset used in this research is CICIDS2017 which is an intrusion detection dataset created in 2017 and published in 2018 by Canadian Institute for Cybersecurity (CIC) [8].”
MethodIliyasu, A. S., Abdurrahman, U. A., & Zheng, L. (2022) · Applied Sciences · doi:10.3390/app12052351 · Cited by 31
“The CIC-IDS2017 dataset reflects recent attacks, and, to some extent, it satisfies the criteria for reliable intrusion detection datasets proposed by [39], which are anonymity, attack diversity, complete capture, complete interaction, complete network configuration, available protocol, complete traffic…”
BackgroundThreat classification model for security information event management focusing on model efficiency
Kim, J.-Y., & Kwon, H.-Y. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102789 · Cited by 40
Evaluation of Boruta algorithm in DDoS detection
Farhana, N., Firdaus, A., Darmawan, M. F., & Razak, M. F. A. (2022) · Egyptian Informatics Journal · doi:10.1016/j.eij.2022.10.005 · Cited by 30
McCarthy, A., Ghadafi, E., Andriotis, P., & Legg, P. (2022) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2022.103398 · Cited by 31
Using Algorithmic Modeling to Control User Access Based on Functioning Table
Kabulov, A., Saymanov, I., Yarashov, I., & Karimov, A. A. (2022) · IEEE International IOT, Electronics and Mechatronics Conference (IEMTRONICS) · doi:10.1109/iemtronics55184.2022.9795850 · Cited by 31
Chen, J., Song, L., Cai, S., Xie, H., Yin, S., & Ahmad, B. (2023) · ACM Transactions on Privacy and Security · doi:10.1145/3613960 · Cited by 30
“(4) CICIDS2017-CTU13: this dataset consists of normal encrypted traffic from the CICIDS2017 dataset [17] and malicious encrypted traffic from CTU13 [8].”
BackgroundMethodZhang, Y., & Wang, Z. (2023) · Applied Sciences · doi:10.3390/app13169363 · Cited by 30
“html (accessed on 1 May 2023) [43], is developed by the Canadian Department of National Defence’s Research and Development Canada (DRDC) for network intrusion detection.”
BackgroundEnhancing IoT Network Security: Unveiling the Power of Self-Supervised Learning against DDoS Attacks
Almaraz-Rivera, J. G., Cantoral-Ceballos, J. A., & Botero, J. F. (2023) · Sensors · doi:10.3390/s23218701 · Cited by 38
“Given the heterogeneous and resource-constrained nature of IoT devices [12], popular datasets like CIC-IDS2017 [13] may not be apt for training necessary machine learning (ML) and deep learning (DL) models, mainly due to the lack of IoT devices in their testbeds.”
BackgroundAsad, H., Adhikari, S., & Gashi, I. (2023) · International Journal of Information Security · doi:10.1007/s10207-023-00794-9 · Cited by 36
Benchmarking the Benchmark - Comparing Synthetic and Real-World Network Ids Datasets
Layeghy, S., Gallagher, M. R., & Portmann, M. (2022) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2023.103689 · Cited by 32
“The first problem was relatively easy, as normal / background traffic were provided in separate files in UNSW-NB15 [2], CIC-IDS2017 [3] and TON IOT [4], and we used the provided metadata to exclude all the attack flows.”
MethodInfluentialKim, D.-J., Amma, N. G. B., & Sarveshwaran, V. (2024) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2024.3367330 · Cited by 32
“The dataset includes several sorts of attacks, including Brute-force (XSS), DDoS, DoS, SSH, etc., along with one normal class [33].”
MethodGöcs, L., & Johanyák, Z. C. (2024) · Intelligent Data Analysis · doi:10.3233/ida-230264 · Cited by 30
Enabling AutoML for Zero-Touch Network Security: Use-Case Driven Analysis
Yang, L., Rajab, M. E., Shami, A. A., & Muhaidat, S. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3376631 · Cited by 37
“…datasets are utilized in these case studies to evaluate the proposed AutoML-based IDS and the AML attack & defense models: the Canadian Institute for Cybersecurity Intrusion Detection System 2017 (CICIDS2017) dataset [85] and the 5th Generation Network Intrusion Detection Dataset (5G-NIDD) [86].”
Khanan, A., Mohamed, Y. A., Mohamed, A. H. H. M., & Bashir, M. (2024) · IEEE Access · doi:10.1109/access.2024.3392338 · Cited by 30
Multi-agent Reinforcement Learning-based Network Intrusion Detection System
Tellache, A., Mokhtari, A., Korba, A. A., & Ghamri-Doudane, Y. M. (2024) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms59830.2024.10575541 · Cited by 36
“In this section, we will evaluate the effectiveness of the proposed IDS by conducting a comprehensive assessment on the CIC-IDS-2017 [22] dataset.”
MethodInfluentialChen, X., Liu, M., Wang, Z., et al. (2024) · Sensors · doi:10.3390/s24165223 · Cited by 30
“The CICIDS2017 dataset, accessible to the public, serves as a repository for intrusion detection and prevention [35].”
BackgroundTaxonomy and Survey of Collaborative Intrusion Detection System using Federated Learning
Wardana, A. A., & Sukarno, P. (2024) · ACM Computing Surveys · doi:10.1145/3701724 · Cited by 43
Metadata
- Authors
- Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A.
- Affiliations
- University of New Brunswick (CA)
- University of New Brunswick (UNB), Canada
- Venue
- Proceedings of the 4th International Conference on Information Systems Security and Privacy
- Published
- 2018
- Pages
- 108-116
- OpenAlex
- W2789828921
- Cited by
- 5,318
- References
- 27
- Citations by year
- 2026: 1170 · 2025: 1032 · 2024: 803 · 2023: 704 · 2022: 558 · 2021: 518 · 2020: 332 · 2019: 165 · 2018: 35
- FWCI
- 215.46
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- cc-by-nc-nd
- Locations
- International Conference on Information Systems Security and Privacy (ICISSP) (publishedVersion, cc-by-nc-nd)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- intrusion detection, intrusion detection datasets, network traffic characterization, network security, dataset construction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
