A Survey of Network-based Intrusion Detection Data Sets
arXiv:1903.02460 · doi:10.1016/j.cose.2019.06.005
Abstract
Labeled data sets are necessary to train and evaluate anomaly-based network intrusion detection systems. This work provides a focused literature survey of data sets for network-based intrusion detection and describes the underlying packet- and flow-based network data in detail. The paper identifies 15 different properties to assess the suitability of individual data sets for specific evaluation scenarios. These properties cover a wide range of criteria and are grouped into five categories such as data volume or recording environment for offering a structured search. Based on these properties, a comprehensive overview of existing data sets is given. This overview also highlights the peculiarities of each data set. Furthermore, this work briefly touches upon other sources for network-based data such as traffic generators and traffic repositories. Finally, we discuss our observations and provide some recommendations for the use and creation of network-based data sets.
submitted manuscript to Computer & Security
References in corpus (2)
Cited by in corpus (31)
- NetFlow Datasets for Machine Learning-based Network Intrusion Detection Systems
- Towards a Standard Feature Set for Network Intrusion Detection System Datasets
- A Taxonomy of Network Threats and the Effect of Current Datasets on Intrusion Detection Systems
- The Role of Machine Learning in Cybersecurity
- I-SiamIDS: an improved Siam-IDS for handling class imbalance in network-based intrusion detection systems
- The Cross-evaluation of Machine Learning-based Network Intrusion Detection Systems
- A new method for flow-based network intrusion detection using the inverse Potts model
- Generalizing intrusion detection for heterogeneous networks: A stacked-unsupervised federated learning approach
- Active Learning for Network Traffic Classification: A Technical Study
- MSTREAM: Fast Anomaly Detection in Multi-Aspect Streams
- Anomaly-Based Intrusion Detection by Machine Learning: A Case Study on Probing Attacks to an Institutional Network
- Network Intrusion Datasets: A Survey, Limitations, and Recommendations
- MBTree: Detecting Encryption RAT Communication Using Malicious Behavior Tree
- AdvSQLi: Generating Adversarial SQL Injections against Real-world WAF-as-a-service
- HSTF-Model: an HTTP-based Trojan Detection Model via the Hierarchical Spatio-Temporal Features of Traffics
- Prepare for Trouble and Make it Double. Supervised and Unsupervised Stacking for AnomalyBased Intrusion Detection
- Benchmarking the Benchmark -- Analysis of Synthetic NIDS Datasets
- Behavioral Authentication for Security and Safety
- Simulation of Multi-Stage Attack and Defense Mechanisms in Smart Grids
- A Systematic Literature Review of Cyber Security Monitoring in Maritime
- Machine Learning for Detecting Data Exfiltration: A Review
- Network Anomaly Detection in Cars: A Case for Time-Sensitive Stream Filtering and Policing
- Collaborative Feature Maps of Networks and Hosts for AI-driven Intrusion Detection
- A Method for Network Intrusion Detection Using Flow Sequence and BERT Framework
- Introducing a Comprehensive, Continuous, and Collaborative Survey of Intrusion Detection Datasets
- Data Curation and Quality Assurance for Machine Learning-based Cyber Intrusion Detection
- Bridging the gap to real-world for network intrusion detection systems with data-centric approach
- Emerging Trends of Recently Published Datasets for Intrusion Detection Systems (IDS): A Survey
- A Hybrid Intrusion Detection with Decision Tree for Feature Selection
- Improving the Reliability of Network Intrusion Detection Systems through Dataset Integration
- What Clinical Trials Can Teach Us about the Development of More Resilient AI for Cybersecurity