The DOI matches its Crossref record; 20 of the 27 references it cites were found in a registry or an index.
Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization
Open accessOverview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Many studies classify feature selection methods into three categories: filter-based techniques, wrapper techniques, and embed techniques”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [210]
Citations
Cites
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396 · cited 3×
“KDD’99 (University of California, Irvine 1998-99): This dataset is an updated version of the DARPA98, by processing the tcpdump portion.”
BackgroundMethodSelf-citationTesting Intrusion detection systems
McHugh, J. (2000) · ACM Transactions on Privacy and Security · doi:10.1145/382912.382923 · Cited by 1,490 · cited 4×
“Moreover, it lacks actual attack data records (McHugh, 2000) (Brown et al.”
BackgroundMethodInfluentialToward developing a systematic approach to generate benchmark datasets for intrusion detection
Shiravi, A., Shiravi, H., Tavallaee, M., & Ghorbani, A. A. (2012) · Computers & Security · doi:10.1016/j.cose.2011.12.012 · Cited by 1,345
Self-citationCharacterization of Tor Traffic using Time based Features
Lashkari, A. H., Gil, G. D., Mamun, M., & Ghorbani, A. A. (2017) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0006105602530262 · Cited by 926 · cited 3×
“We begin to extract the 80 traffic features from the dataset using CICFlowMeter (CICFlowMeter, 2017),(Habibi Lashkari et al., 2017).”
MethodSelf-citationStatistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation
Song, J., Takakura, H., Okabe, Y., Eto, M., Inoue, D., & Nakao, K. (2011) · International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security · doi:10.1145/1978672.1978676 · Cited by 335 · cited 2×
“The normal traffic here has been simulated repeatedly during the attacks and producing only DNS and mail traffic data, which is not reflected in real world normal network traffic, so there are no false positives, which are important for minimizing the number of alerts (Song et al., 2011) (M.”
BackgroundGeneration of a new IDS test dataset: Time to retire the KDD collection
Creech, G., & Hu, J.-K. (2013) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc.2013.6555301 · Cited by 326 · cited 1×
“ADFA (University of New South Wales 2013): This dataset includes normal training and validating data and 10 attacks per vector (Creech and Hu, 2013).”
MethodTowards a Reliable Intrusion Detection Benchmark Dataset
Sharafaldin, I., Gharib, A., Lashkari, A. H., & Ghorbani, A. A. (2017) · Software Networking · doi:10.13052/jsn2445-9739.2017.009 · Cited by 309 · cited 9×
“Finally, we evaluate the quality of the generated dataset by searching for common mistakes and criticisms of other synthetically created datasets, based on the 11 criteria from the last proposed dataset evaluation framework by Canadian Institute for Cybersecurity (CIC)(Sharafaldin et al., 2017).”
MethodInfluentialSelf-citationAn Evaluation Framework for Intrusion Detection Dataset
Gharib, A., Sharafaldin, I., Lashkari, A. H., et al. (2016) · International Conferences on Information Science and System · doi:10.1109/icissec.2016.7885840 · Cited by 224 · cited 6×
“Regarding to the last dataset evaluation framework published on 2016 (Gharib et al., 2016), covering eleven criteria is necessary for each dataset.”
BackgroundMethodInfluentialSelf-citationNetwork Intrusion Detection and Prevention - Concepts and Techniques
Ghorbani, A., Lu, W., & Tavallaee, M. (2009) · Advances in Information Security · doi:10.1007/978-0-387-88771-5 · Cited by 175 · cited 1×
“Since 1999, Scott et al. (Scott and Wilkins, 1999), Heideman and Papadopulus (Heidemann and Papdopoulos, 2009), Ghorbani et al. (Ghorbani Ali and Mahbod, 2010), Nehinbe (Nehinbe, 2011), Shiravi et al. (Ali Shiravi and Ghorbani, 2012), and Sharfaldin et al. (Gharib et al., 2016) tried to propose an…”
BackgroundSelf-citationA Labeled Data Set for Flow-Based Intrusion Detection
Sperotto, A., Sadre, R., van Vliet, F., & Pras, A. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04968-2_4 · Cited by 155 · cited 1×
“It is labelled and is more realistic, but the lack of volume and diversity of attacks is obvious (Sperotto et al., 2009).”
Background
Cited by
Sorted by citations
Items 801–900 of 1,010
Rajathi, C., & Rukmani, P. (2024) · Alexandria Engineering Journal · doi:10.1016/j.aej.2024.10.101 · Cited by 30
Kumar, V., Kumar, K., Singh, M., & Kumar, N. (2025) · Expert Systems with Applications · doi:10.1016/j.eswa.2025.126513 · Cited by 34
SDN-Enabled IoT Security Frameworks—A Review of Existing Challenges
Mishra, S. R., Shanmugam, B., Yeo, K. C., & Thennadil, S. N. (2025) · Technologies · doi:10.3390/technologies13030121 · Cited by 43
SoK: Decoding the Enigma of Encrypted Network Traffic Classifiers
Wickramasinghe, N. C., Shaghaghi, A., Tsudik, G., & Jha, S. K. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00165 · Cited by 49
“Similarly, the CIC-IDS2018 dataset [72] contains a range of intrusion scenarios alongside normal traffic.”
Federated Learning for Cybersecurity: A Privacy-Preserving Approach
Timofte, E. M., Dimian, M., Graur, A., et al. (2025) · Applied Sciences · doi:10.3390/app15126878 · Cited by 30
“…to safeguard the system against quantum-capable adversaries and align with emerging cryptographic standards [1]; • From a regulatory perspective, the architecture is compatible with GDPR and HIPAA principles by minimizing data exposure and supporting verifiable processing trails [13,14].”
InfluentialStudy of long short-term memory in flow-based network intrusion detection system
Lee, N., Yin, O. S., Pang, Y. H., Hwang, S. O., & Tan, S. (2018) · Journal of Intelligent & Fuzzy Systems · doi:10.3233/jifs-169836 · Cited by 31
“At the time of writing, the most recent data set is CICIDS2017 by Sharafaldin et al. [32].”
Isolation Mondrian Forest for Batch and Online Anomaly Detection
Ma, H., Ghojogh, B., Samad, M. N., Zheng, D., & Crowley, M. (2020) · Conference proceedings/Conference proceedings - IEEE International Conference on Systems, Man, and Cybernetics · doi:10.1109/smc42975.2020.9283073 · Cited by 36
“We selected eight varied datasets with different characteristics from the outlier detection datasets [23] and one very large dataset, CICIDS 2017 [24], [25].”
MethodPerformance Evaluation of Botnet Detection using Deep Learning Techniques
Nugraha, B., Nambiar, A., & Bauschert, T. (2020) · International Conference on the Network of the Future (NOF) · doi:10.1109/nof50125.2020.9249198 · Cited by 35
“As the CTU-13 dataset exclusively comprises botnet traffic traces it is better suited for botnet research than more recent datasets such as CSE-CIC-IDS2018 [19].”
MethodSMOTE: Class Imbalance Problem In Intrusion Detection System
ALFRHAN, A. A., AlHusain, R., & Khan, R. U. (2020) · International Conference on Computing and Information Technology (ICCIT) · doi:10.1109/iccit-144147971.2020.9213728 · Cited by 34
“For building strong IDSs, a strong dataset is needed to evaluate the performance of the proposed IDSs based on machine learning algorithms, that produce an accurate result of the IDS performance [4].”
BackgroundMethodInfluentialLópez‐Martín, M., Carro, B., Arribas, J. I., & Sánchez-Esguevillas, A. (2021) · Knowledge-Based Systems · doi:10.1016/j.knosys.2021.106887 · Cited by 32
Zoppi, T., & Ceccarelli, A. (2021) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2021.103106 · Cited by 30
Building an Intrusion Detection System to Detect Atypical Cyberattack Flows
Sabeel, U., Heydari, S. S., Elgazzar, K., & El‐Khatib, K. (2021) · IEEE Access · doi:10.1109/access.2021.3093830 · Cited by 30
“This benchmark dataset contains the most recent attacks that resemble real-world attacks [51], [52].”
BackgroundMethodAlikhanov, J., Jang, R., Abuhamad, M., Mohaisen, A., Nyang, D., & Noh, Y. (2021) · IEEE Access · doi:10.1109/access.2021.3137318 · Cited by 30
“To address this issue recently new datasets CIC-IDS-2017 , AWS CIC-IDS-2018 , and DDoS 2019 were released [12].”
BackgroundMethodResultInfluentialAn Intrusion Detection System for IoT Using KNN and Decision-Tree Based Classification
Abdaljabar, Z. H., Osman Nuri, U. C. A. N., & Alheeti, K. M. A. (2021) · International Conference of Modern Trends in Information and Communication Technology Industry (MTICTI) · doi:10.1109/mticti53925.2021.9664772 · Cited by 37
Machine learning approaches to network intrusion detection for contemporary internet traffic
Ilyas, M., & Alharbi, S. A. (2022) · Computing · doi:10.1007/s00607-021-01050-5 · Cited by 30
“Sharafaldin, Lashkari, and Ghorbani [16] collected the CIC-IDS2017 dataset in a collaboration between the Communications Security Establishment (CSE) and the Canadian Institute for Cybersecurity (CIC).”
BackgroundMethodSilva, J. V. V., de Oliveira, N. R., Medeiros, D. S. V., et al. (2022) · Annals of Telecommunications · doi:10.1007/s12243-021-00904-5 · Cited by 30
“To generate realistic traffic data, the B-Profile System [17] was used to profile the abstract behavior of human interactions and generate naturalistic benign background traffic.”
BackgroundMethodDomain Knowledge-Aided Explainable Artificial Intelligence
Islam, S. R., & Eberle, W. (2022) · Studies in computational intelligence · doi:10.1007/978-3-030-96630-0_4 · Cited by 30
Feature Selection by Hybrid Artificial Bee Colony Algorithm for Intrusion Detection
Stanković, M. S., Antonijević, M., Bačanin, N., et al. (2022) · International Conference on Edge Computing and Applications (ICECAA) · doi:10.1109/icecaa55415.2022.9936116 · Cited by 30
“All other details of UNSW-NB15 can be captured from the [18], [19].”
BackgroundMethodAn implementation of bi-phase network intrusion detection system by using real-time traffic analysis
Chowdhury, R., Sen, S., Goswami, A., Purkait, S., & Saha, B. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.119831 · Cited by 30
ALDD: A Hybrid Traffic-User Behavior Detection Method for Application Layer DDoS
Jiang, J., Yu, Q., Yu, M., et al. (2018) · doi:10.1109/trustcom/bigdatase.2018.00225 · Cited by 30
Haider, S., Akhunzada, A., Ahmed, G., & Raza, M. (2019) · International Conference on UK-China Emerging Technologies (UCET) · doi:10.1109/ucet.2019.8881856 · Cited by 35
“For the detailed information on captured and extracting network traffic features, refer to [10].”
BackgroundMethodInfluentialAlotaibi, A., & Rassam, M. A. (2023) · Sustainability · doi:10.3390/su15129801 · Cited by 29
“Building two CNN-based IDS models as a network classifier (IDS) with the CICIDS2017 [10] dataset; 2.”
MethodNetwork Intrusion Detection Based on Feature Image and Deformable Vision Transformer Classification
He, K., Zhang, W., Zong, X., & Lian, L. (2024) · IEEE Access · doi:10.1109/access.2024.3376434 · Cited by 33
“We found that our method utilizing the DE-VIT classifier outperforms all other methods in terms of accuracy and precision on both the UNSW-NB15 [33] and CIC IDS2017 [32] datasets.”
BackgroundMethodInfluentialJan, M. A., Adil, M., Brik, B., Harous, S., & Abbas, S. (2025) · ACM Computing Surveys · doi:10.1145/3716371 · Cited by 30
“— High Dimensionality and Complexity: In Big data–driven ITS, the sheer volume and complexity of data make it tough for traditional ML algorithms to choose the right features and train IDS models effectively [103, 104].”
Firouzi, A., Dadkhah, S., Maret, S. A., & Ghorbani, A. A. (2025) · Electronics · doi:10.3390/electronics14204095 · Cited by 33
“The CIC-IDS2017 dataset [15] provides realistic traffic patterns and various types of attacks, making it suitable for evaluating intrusion detection systems.”
Self-citationExplainability and Adversarial Robustness for RNNs
Hartl, A., Bachl, M., Fabini, J., & Zseby, T. (2020) · IEEE International Conference on Big Data Computing Service and Applications (BigDataService) · doi:10.1109/bigdataservice49289.2020.00030 · Cited by 32
“The results show that – surprisingly – there is only a small difference in classification performance when looking at flow accuracy: It is slightly lower at 99.3% compared to 99.7% originally for CIC-IDS-2017.”
MethodInfluentialMLP4NIDS: An Efficient MLP-Based Network Intrusion Detection for CICIDS2017 Dataset
Rosay, A., Carlier, F., & Leroux, P. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-45778-5_16 · Cited by 29
A Hybrid Intrusion Detection System for Smart Home Security
Alghayadh, F. Y., & Debnath, D. (2020) · IEEE International Conference on Electro Information Technology · doi:10.1109/eit48999.2020.9208296 · Cited by 29
“It also has eighty network traffic features that have been extracted from the captured traffic through the use of CICFlowMeter-V3 (UNB, 2018) [21].”
MethodNetwork Intrusion Detection System using Feature Extraction based on Deep Sparse Autoencoder
Lee, J., Pak, J.-G., & Lee, M. (2020) · International Conference on Information and Communication Technology Convergence (ICTC) · doi:10.1109/ictc49870.2020.9289253 · Cited by 29
T‐SNERF: A novel high accuracy machine learning approach for Intrusion Detection Systems
Hammad, M., Hewahi, N. M., & Elmedany, W. M. (2021) · IET Information Security · doi:10.1049/ise2.12020 · Cited by 29
“Also, random forest accuracy has been increased by 2.4% by implementing T‐SNE algorithm prior to the classification to achieve 100% accuracy and 0% FPR using nine features selected using CFS. Experiment 2: CICIDS‐2017 dataset.”
MethodInfluentialAnomaly Detection in Smart Environments using AI over Fog and Cloud Computing
Moreira, D. A. B., Marques, H. P., Costa, W. L., et al. (2021) · IEEE Consumer Communications & Networking Conference (CCNC) · doi:10.1109/ccnc49032.2021.9369449 · Cited by 29
“The workload for experiments follows the network flows in the Intrusion Detection Evaluation Dataset (CICIDS) [5].”
MethodDemystifying the role of public intrusion datasets: A replication study of DoS network traffic data
Catillo, M., Pecchia, A., Rak, M., & Villano, U. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102341 · Cited by 34
A Deep Learning Approach for Botnet Detection Using Raw Network Traffic Data
Shahhosseini, M., Mashayekhi, H., & Rezvani, M. (2022) · Journal of Network and Systems Management · doi:10.1007/s10922-022-09655-7 · Cited by 33
“For the final classifier, we either use the LSTM network itself, or a Random Forest (RF) which is a widely used learning approach that has demonstrated good accuracy in botnet detection studies [26, 36].”
MethodFLDDoS: DDoS Attack Detection Model based on Federated Learning
Zhang, J., Yu, P., Qi, L., Liu, S., Zhang, H., & Zhang, J. (2021) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom53373.2021.00095 · Cited by 32
“The contributions of this paper are as follows: • We design a DDoS detection model based on federated learning called FLDDoS, which has good detection per-fomance and scalability illustrated by experiments on different datasets, including CICDDoS [1], NLSKDD [5] and CICIDS [6].”
MethodIDS-ML: An open source code for Intrusion Detection System development using Machine Learning
Yang, L., & Shami, A. A. (2022) · Software Impacts · doi:10.1016/j.simpa.2022.100446 · Cited by 29
Coelho, B. L., & Schaeffer-Filho, A. E. (2022) · doi:10.1145/3565475.3569074 · Cited by 29
“In order to evaluate BACKORDERS, we utilized the CICIDS2017 dataset [14].”
MethodSynGAN: Towards Generating Synthetic Network Attacks using GANsPreprint
Charlier, J., Singh, A. K., Ormazábal, G., et al. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1908.09899 · Cited by 29
“We concentrated, therefore, on the CICIDS2017 dataset that has in excess of 10,000 DDoS attack samples including the GoldenEye attack.”
MethodInfluentialAbdulla, A. R., & Jameel, N. G. M. (2023) · UHD Journal of Science and Technology · doi:10.21928/uhdjst.v7n1y2023.pp53-65 · Cited by 28
A Survey of Using Machine Learning in IoT Security and the Challenges Faced by Researchers
Harahsheh, K., & Chen, C. (2023) · Informatica · doi:10.31449/inf.v47i6.4635 · Cited by 38
Pandit, P. V., Bhushan, S., & Waje, P. V. (2023) · doi:10.1109/incacct57535.2023.10141704 · Cited by 28
“The issues involve, but are not limited to traffic of the attack, privacy depend on ethics, redundancy and traffic which is simulated that is not from a genuine production network, and a lack of traffic variety and an allencompassing dataset [4].”
BackgroundGPT and Interpolation-Based Data Augmentation for Multiclass Intrusion Detection in IIoT
Melícias, F. S., Ribeiro, T., Rabadao, C. M. D. S., Santos, L., & Costa, R. L. D. C. (2024) · IEEE Access · doi:10.1109/access.2024.3360879 · Cited by 33
Unsupervised intrusion detection system for in-vehicle communication networks
Kabilan, N., Ravi, V., & Sowmya, V. (2024) · Journal of Safety Science and Resilience · doi:10.1016/j.jnlssr.2023.12.004 · Cited by 28
Yang, T., Qiao, Y., & Lee, B. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103909 · Cited by 29
Khediri, A., Slimi, H., Yahiaoui, A., et al. (2024) · International Conference on Pattern Analysis and Intelligent Systems (PAIS) · doi:10.1109/pais62114.2024.10541168 · Cited by 28
Enhancing Multi-Class Attack Detection in Graph Neural Network through Feature Rearrangement
Le, H.-D., & Park, M. (2024) · Electronics · doi:10.3390/electronics13122404 · Cited by 33
Jiang, W., Han, H., Zhang, Y., Mu, J., & Shankar, A. (2024) · Mobile Networks and Applications · doi:10.1007/s11036-024-02435-4 · Cited by 31
Hariharan, S., Jerusha, Y. A., Suganeshwari, G., Ibrahim, S. P. S., Tupakula, U. K., & Varadharajan, V. (2025) · IEEE Access · doi:10.1109/access.2025.3541399 · Cited by 39
NFV-based IoT Security for Home Networks using MUD
Afek, Y., Bremler-Barr, A., Hay, D. A., et al. (2020) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms47738.2020.9110329 · Cited by 28
“, for improving QoS of a video streaming): In our study, of IoT traffic logs [33], [34] , [35] and IoT devices in our lab, out of 42 IoT devices, five IoT devices1 and one IoT alarm system act as servers.”
BackgroundNetwork Intrusion Detection in Smart Grids for Imbalanced Attack Types Using Machine Learning Models
Roy, D. D., & Shin, D. (2019) · International Conference on Information and Communication Technology Convergence (ICTC) · doi:10.1109/ictc46691.2019.8939744 · Cited by 28
“In this paper, we study various machine learning models to overcome this drawback by using CIC-IDS2018 dataset [1].”
MethodP4ID: P4 Enhanced Intrusion Detection
Lewis, B., Broadbent, M. T. M., & Race, N. (2019) · IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN) · doi:10.1109/nfv-sdn47374.2019.9040044 · Cited by 28
Multi-Stage Attack Detection via Kill Chain State Machines
Wilkens, F., Ortmann, F., Haas, S., Vallentin, M., & Fischer, M. (2021) · doi:10.1145/3474374.3486918 · Cited by 38
“This process resulted in a coherent attack scenario that took place at the time of the original CSE-CIC-IDS2018 data set (02.18–03.18).”
MethodInfluentialKim, C., Jang, M., Seo, S., Park, K., & Kang, P. (2021) · IEEE Access · doi:10.1109/access.2021.3071763 · Cited by 27
“The intrusion detection system is a representative defense mechanism to protect a system from the continuously increasing attacks which are designed more precisely [2].”
BackgroundDesign and Development of IOT Testbed with DDoS Attack for Cyber Security Research
Arthi, R., & Krishnaveni, S. (2021) · doi:10.1109/icspc51351.2021.9451786 · Cited by 28
“The CICDS2017 [7]”
MethodReproducible and Adaptable Log Data Generation for Sound Cybersecurity Experiments
Uetz, R., Hemminghaus, C., Hackländer, L., Schlipper, P., & Henze, M. (2021) · Annual Computer Security Applications Conference · doi:10.1145/3485832.3488020 · Cited by 30
“Unfortunately, there is a significant lack of such data in the scientific community [65] and freely available datasets usually do not match researchers’ requirements for novel experiments [55].”
BackgroundInfluentialAn Intrusion Detection System for Imbalanced Dataset Based on Deep Learning
Mbow, M., Koide, H., & Sakurai, K. (2021) · International Symposium on Computing and Networking · doi:10.1109/candar53791.2021.00013 · Cited by 36
Brunner, C., Kő, A., & Fodor, S. (2021) · Journal of Artificial Intelligence and Soft Computing Research · doi:10.2478/jaiscr-2022-0010 · Cited by 28
“In the future, we are planning to test our models on recently published datasets such as UNSW-NB15 [32] or either the 2017 or 2018 version of the CSE-CIC-IDS-20xx [42], and we will pay attention to increasing the recall rate on majority classes using VAEs and CVAEs in hyperparameter search.”
MethodD’hooge, L., Verkerken, M., Volckaert, B., Wauters, T., & Turck, F. D. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-09484-2_2 · Cited by 30
Joint Semantic Transfer Network for IoT Intrusion Detection
Wu, J., Wang, Y., Xie, B., Li, S., Dai, H., Ye, K., & Xu, C. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3218339 · Cited by 28
“Network Intrusion Dataset: CICIDS2017 The CI-CIDS2017 (C) [45] network intrusion dataset was released in 2017.”
MethodSingh, A. P., Prakash, J., Kumar, G., Jain, P. K., & Ambati, L. S. (2024) · Journal of Database Management · doi:10.4018/jdm.338276 · Cited by 38
“Sharafaldin et al. (Sharafaldin et al., 2018) analyzed the properties of eleven IDS datasets since 1998 and showed that most are outdated and unreliable.”
BackgroundMethodConceptualisation of Cyberattack prediction with deep learning
Ibor, A. E., Oladeji, F. A., Okunoye, O. B., & Ekabua, O. O. (2020) · Cybersecurity · doi:10.1186/s42400-020-00053-7 · Cited by 35
“It has 80 features with 13 attack types and 1 benign (or normal) traffic (Shara-faldin et al. 2018a; Sharafaldin et al. 2018b; and Shar-afaldin et al. 2018c)..”
BackgroundBenchmarking Deep Learning Methods for Behaviour-Based Network Intrusion Detection
Antunes, M., Oliveira, L., Seguro, A., Veríssimo, J., Salgado, R., & Murteira, T. (2022) · Informatics · doi:10.3390/informatics9010029 · Cited by 27
Peng, H., Wu, C., & Xiao, Y. (2023) · Applied Sciences · doi:10.3390/app132111629 · Cited by 33
Marina : Realizing ML-Driven Real-Time Network Traffic Monitoring at Terabit Scale
Seufert, M., Dietz, K., Wehner, N., Geißler, S., Schüler, J., Wolz, M., Andreas Hotho, A., Casas, P., Hoßfeld, T., & Feldmann, A. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3382393 · Cited by 28
“3 Intrusion Detection: the ever-growing number and complexity of cyberattacks [71] pushes network operators beyond static defenses, such as firewalls, to deeper Intrusion Detection Systems (IDSs) [72], [73], relying on DPI technology to detect and potentially block known malicious traffic.”
Saurabh, K., Sharma, V., Singh, U., et al. (2024) · Arabian Journal for Science and Engineering · doi:10.1007/s13369-024-08935-5 · Cited by 27
Abreu, R., Simão, E., Serôdio, C., et al. (2024) · AI · doi:10.3390/ai5040112 · Cited by 27
Network-Based Intrusion Detection for Industrial and Robotics Systems: A Comprehensive Survey
Holdbrook, R., Odeyomi, O. T., Yi, S., & Roy, K. (2024) · Electronics · doi:10.3390/electronics13224440 · Cited by 32
XI2S-IDS: An Explainable Intelligent 2-Stage Intrusion Detection System
Mahmoud, M. M., Omar, Y. M. K., & Abdel-Hamid, A. (2025) · Future Internet · doi:10.3390/fi17010025 · Cited by 28
“The CICIDS2017 dataset [42] comprises 2,273,097 normal records and 557,646 attack records distributed over 14 attack classes.”
Analyzing the Footprint of Classifiers in Adversarial Denial of Service Contexts
Martins, N., Cruz, J. M., Cruz, T., & Abreu, P. H. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-30244-3_22 · Cited by 28
A novel network intrusion detection algorithm based on Fast Fourier Transformation
Liu, W., Liu, X., Di, X., et al. (2019) · International Conference on Industrial Artificial Intelligence (IAI) · doi:10.1109/iciai.2019.8850770 · Cited by 27
“With the opening research on intrusion detection, there are also other organizations sharing the dataset for evaluation, such as UNSW-NB15 [7], ISCXIDS [8], [9], and so on.”
BackgroundClassification Hardness for Supervised Learners on 20 Years of Intrusion Detection Data
D’hooge, L., Wauters, T., Volckaert, B., et al. (2019) · IEEE Access · doi:10.1109/access.2019.2953451 · Cited by 27
“Five years after publishing ISCXIDS2012 a new version CICIDS2017 ( [21], [22]) was released that expanded the scale of the experiment, the available dynamic baseline and attack scenarios.”
BackgroundLightweight Convolutional Neural Network Based Intrusion Detection System
Sungkyunkwan University, S. A. 1., Pham, V., Seo, E., & Chung, T.-M. (2020) · Journal of Communications · doi:10.12720/jcm.15.11.808-817 · Cited by 27
“In this work, we employed two widely used datasets to evaluate our proposed IDS: CSE-CIC-IDS2018 (IDS2018) [19] and ISCX-VPN2016 (VPN2016) [20].”
MethodImproving the performance of the intrusion detection systems by the machine learning explainability
Dang, Q.-V. (2021) · International Journal of Web Information Systems · doi:10.1108/ijwis-03-2021-0022 · Cited by 28
Haque, N. I., Shahriar, M. H., Dastgir, M. G., et al. (2021) · North American Power Symposium (NAPS) · doi:10.1109/naps50074.2021.9449635 · Cited by 27
“75% recall [33], [43] DT coupled SVM (Novel) ET NA NA NA 92.”
BackgroundMethodUnsupervised Federated Learning based IoT Intrusion Detection
Yadav, K., Gupta, B. B., Hsu, C., et al. (2021) · IEEE Global Conference on Consumer Electronics (GCCE) · doi:10.1109/gcce53005.2021.9621784 · Cited by 27
Feature Entropy Estimation (FEE) for Malicious IoT Traffic and Detection Using Machine Learning
Diwan, T. D., Choubey, S., Hota, H. S., et al. (2021) · Mobile Information Systems · doi:10.1155/2021/8091363 · Cited by 27
Guarino, I., Bovenzi, G., Monda, D. D., Aceto, G., Ciuonzo, D., & Pescapè, A. (2022) · IEEE International Symposium on Measurements & Networking (M&N) · doi:10.1109/mn55117.2022.9887775 · Cited by 28
“Collection Setup and Preprocessing: CSE-CIC-IDS2018 on Amazon Web Services (AWS) dataset [2] is the result of a”
BackgroundAn Intrusion Detection Model for CICIDS-2017 Dataset Using Machine Learning Algorithms
Panwar, S. S., Raiwani, Y. P., & Panwar, L. S. (2022) · International Conference on Advances in Computing, Communication and Materials (ICACCM) · doi:10.1109/icaccm56405.2022.10009400 · Cited by 27
Tayfour, O. E., Mubarakali, A., Ahmed, A. E. T., Marsono, M. N., Hassan, E., & Abdelrahman, A. M. (2023) · Soft Computing · doi:10.1007/s00500-023-08348-w · Cited by 27
RetractedSharif, D. M., Beitollahi, H., & Fazeli, M. (2023) · IEEE Access · doi:10.1109/access.2023.3280122 · Cited by 27
“The CICIDS2017 [24] dataset is used in this work where the abstract behavior of 25 users are profiled based on the HTTP, HTTPS, FTP, and SSH protocols, as well as email.”
MethodSec2graph: Network Attack Detection Based on Novelty Detection on Graph Structured Data
Leichtnam, L., Totel, É., Prigent, N., & Mé, L. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-52683-2_12 · Cited by 29
“We choose to use the CICIDS2017 dataset [31] that is made of five pcap and csv files encompassing more than two million network sessions.”
MethodInfluentialAhmed, M. R., Islam, S., Shatabda, S., Islam, A. K. M. M., & Robin, M. T. I. (2021) · doi:10.36227/techrxiv.17153213.v1 · Cited by 37
Ayubkhan, S. A. H., Yap, W., Morris, E., & Rawthar, M. B. K. (2022) · Journal of Ambient Intelligence and Humanized Computing · doi:10.1007/s12652-022-04449-w · Cited by 27
“Table 26 shows the confusion matrix for the “Normal” of the dataset CIC-IDS-2017.”
BackgroundInfluentialAutonomous Federated Learning for Distributed Intrusion Detection Systems in Public Networks
Mahmoodi, A. B. Z., Sheikhi, S., Peltonen, E., & Kostakos, P. (2023) · IEEE Access · doi:10.1109/access.2023.3327922 · Cited by 26
“The most prominent of these datasets include DARPA [34], KDDCup99 [54], NSL-KDD [54], Kyoto [52], UNSW-NB15 [41], CIC-IDS2017 [50], CSE-CIC-IDS2018 [50], WSN-DS [11], DEFCON [44], CAIDA [3], CDX [2], CIC DoS [4], ISCX [5], ADFA2013 [1], TON_IoT [40], MAWI [6].”
BackgroundEffective Intrusion Detection in Highly Imbalanced IoT Networks With Lightweight S2CGAN-IDS
Wang, C., Xu, D., Li, Z., & Niyato, D. T. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3342638 · Cited by 35
Network intrusion detection leveraging multimodal features
Kiflay, A., Tsokanos, A., Fazlali, M., & Kirner, R. (2024) · Array · doi:10.1016/j.array.2024.100349 · Cited by 36
“Consequently, new datasets such as CDX [63], CICIDS2017 [64] and UNSW-NB15 [60] have been developed by researchers.”
HRNN: Hypergraph Recurrent Neural Network for Network Intrusion Detection
Yang, Z., Ma, Z., Zhao, W., Li, L., & Gu, F. (2024) · Journal of Grid Computing · doi:10.1007/s10723-024-09767-1 · Cited by 29
The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users
Dietz, K., Mühlhauser, M., Kögel, J., Schwinger, S., Sichermann, M., Seufert, M., Herrmann, D., & Hoßfeld, T. (2024) · IEEE Access · doi:10.1109/access.2024.3406939 · Cited by 26
“Among the included papers, the most used dataset is the CIC-IDS 2017 [205] dataset, which is used in almost 25 % of papers.”
MethodFedNIDS: A Federated Learning Framework for Packet-Based Network Intrusion Detection System
Nguyen, Q. H., Hore, S., Shah, A., Le, T. Q., & Bastian, N. D. (2024) · Digital Threats Research and Practice · doi:10.1145/3696012 · Cited by 33
“The details can be found on the CIC Web site [1], and the threat model for the conducted attacks is outlined in [46].”
Balanced Multi-Class Network Intrusion Detection Using Machine Learning
Khan, F. A., Shah, A. A., Alshammry, N., Saif, S., Khan, W., Malik, M. O., & Ullah, Z. (2024) · IEEE Access · doi:10.1109/access.2024.3503497 · Cited by 36
Khatun, M. A., Eising, C., & Dhirani, L. L. (2025) · IEEE Access · doi:10.1109/access.2025.3531659 · Cited by 26
“Nevertheless, the proposed method achieves high accuracy across multiple datasets, including WSN_DDoS_Attack_H-IoT2023 [10], WUSTL-EHMS-2020 [35], BoT-IoT 2018 [39], and CIC-IDS2017 [42], with accuracy rates of 99.84%, 93.34%, 100%, and 99.57%, respectively.”
InfluentialA Lightweight and Dynamic Open-Set Intrusion Detection for Industrial Internet of Things
Yang, X., Tong, F., Jiang, F. M., & Cheng, G. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3546849 · Cited by 34
“In the experiments, we utilize Gas Pipeline, Water Storage Tank [39], CICIDS2017 [40] and NSL-KDD [41] as the benchmark datasets.”
Toward Zero Touch Networks: Cross-Layer Automated Security Solutions for 6G Wireless Networks
Yang, L., Naser, S. A., Shami, A. A., Muhaidat, S., Ong, L. Y., & Debbah, M. A. (2025) · IEEE Transactions on Communications · doi:10.1109/tcomm.2025.3547764 · Cited by 26
“…namely the Oracle Radio Frequency (RF) fingerprinting [18] and the Canadian Institute for Cyber-security Intrusion Detection System 2017 (CICIDS2017) [19] datasets. iv) It discusses the open challenges and research directions of developing cybersecurity solutions for ZTNs and future networks.”
Gaber, T., Ali, T., Nicho, M., et al. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3555202 · Cited by 26
“Theloss function for the Discriminator is The loss function for the Generator is Our experiment expands to use the CICIDS2018 dataset [43] to evaluate the robustness of the proposed IDS model in detecting more diverse network environments by using different for number of discriminator iterations do…”
Performance Evaluation of a Combined Anomaly Detection Platform
Monshizadeh, M., Khatri, V., Atli, B. G., Kantola, R., & Yan, Z. (2019) · IEEE Access · doi:10.1109/access.2019.2930832 · Cited by 26
“DDoS, Infiltration, Heart-bleed, Bot and Scan covered in this dataset [17].”
BackgroundAn Optimal Intrusion Detection System using GWO-CSA-DSAE Model
Keserwani, P. K., Govil, M. C., & Pilli, E. S. (2020) · Cyber-Physical Systems · doi:10.1080/23335777.2020.1811383 · Cited by 26
“The proposed structure for intrusion detection in the network uses NSL-KDD [44], UNSW-NB15 [45] and CICIDS-2017 [46] datasets.”
MethodTensor based framework for Distributed Denial of Service attack detection
Maranhão, J. P. A., da Costa, J. P. C. L., Javidi, E., de Andrade, C. A. B., & de Sousa, R. T. (2020) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2020.102894 · Cited by 26
Early-Stage Detection of Cyber Attacks
Pivarníková, M., Sokol, P., & Bajtoš, T. (2020) · Information · doi:10.3390/info11120560 · Cited by 26
“As mentioned above, the .pcap files from the CICIDS2017 dataset were analyzed by the Snort intrusion detection system.”
MethodInfluentialA Lightweight Decision-Tree Algorithm for detecting DDoS flooding attacks
Lucky, G., Jjunju, F. P. M., & Marshall, A. (2020) · IEEE International Conference on Software Quality, Reliability and Security Companion (QRS-C) · doi:10.1109/qrs-c51114.2020.00072 · Cited by 29
“Additionally, the Canadian Institute of Cybersecurity (CIC) 2017 and 2019 DDoS datasets containing benign and up-todate DDoS attacks which were generated using a real network environment were used to test the validity and robustness of the selected DT models [6], [7].”
MethodNetwork intrusion detection using sparse autoencoder with swish-PReLU activation Model
Kannari, P. R., Shariff, C. N., & Biradar, R. L. (2021) · Journal of Ambient Intelligence and Humanized Computing · doi:10.1007/s12652-021-03077-0 · Cited by 30
Yan, M., Chen, Y., Hu, X., et al. (2021) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2021.102212 · Cited by 26
Metadata
- Authors
- Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A.
- Affiliations
- University of New Brunswick (CA)
- University of New Brunswick (UNB), Canada
- Venue
- Proceedings of the 4th International Conference on Information Systems Security and Privacy
- Published
- 2018
- Pages
- 108-116
- OpenAlex
- W2789828921
- Cited by
- 5,318
- References
- 27
- Citations by year
- 2026: 1170 · 2025: 1032 · 2024: 803 · 2023: 704 · 2022: 558 · 2021: 518 · 2020: 332 · 2019: 165 · 2018: 35
- FWCI
- 215.46
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- cc-by-nc-nd
- Locations
- International Conference on Information Systems Security and Privacy (ICISSP) (publishedVersion, cc-by-nc-nd)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- intrusion detection, intrusion detection datasets, network traffic characterization, network security, dataset construction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
