Generating Network Intrusion Detection Dataset Based on Real and Encrypted Synthetic Attack Traffic
Source abstract
Abstract
The lack of publicly available up-to-date datasets contributes to the difficulty in evaluating intrusion detection systems. This paper introduces HIKARI-2021, a dataset that contains encrypted synthetic attacks and benign traffic. This dataset conforms to two requirements: the content requirements, which focus on the produced dataset, and the process requirements, which focus on how the dataset is built. We compile these requirements to enable future dataset developments and we make the HIKARI-2021 dataset, along with the procedures to build it, available for the public.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Internet Traffic Analysis and Secure E-voting · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Graduate School of Media and Governance, Keio University, Kanagawa 252-0882, Japan
Faculty of Environment and Information Studies, Keio University, Kanagawa 252-0882, Japan
Keio University, Tokyo 108-8345, Japan
References (68)
Show source-provided references
1. Toward credible evaluation of anomaly-based intrusion-detection methods10.1109/TSMCC.2010.2048428 ↗
2. Aviv, A.J., and Haeberlen, A. (2011, January 8). Challenges in Experimenting with Botnet Detection Systems. Proceedings of the 4th Workshop on Cyber Security Experimentation and Test (CSET 11), San Francisco, CA, USA.
3. A survey of methods for encrypted traffic classification and analysis10.1002/nem.1901 ↗
4. De Lucia, M.J., and Cotton, C. (2018, January 15–19). Identifying and detecting applications within TLS traffic. Proceedings of the Cyber Sensing 2018, Orlando, FL, USA.10.1117/12.2305256 ↗
5. Automatic attack signature generation systems: A review10.1109/MSP.2013.51 ↗
6. A survey of network anomaly detection techniques10.1016/j.jnca.2015.11.016 ↗
7. (2021, May 10). Zeek IDS. Available online: https://zeek.org.
8. Toward developing a systematic approach to generate benchmark datasets for intrusion detection10.1016/j.cose.2011.12.012 ↗
9. The evaluation of Network Anomaly Detection Systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set10.1080/19393555.2015.1125974 ↗
10. UGR ‘16: A new dataset for the evaluation of cyclostationarity-based network IDSs10.1016/j.cose.2017.11.004 ↗
11. Lippmann, R.P., Fried, D.J., Graf, I., Haines, J.W., Kendall, K.R., McClung, D., Weber, D., Webster, S.E., Wyschogrod, D., and Cunningham, R.K. (2000, January 25–27). Evaluating intrusion detection systems: The 1998 DARPA off-line intrusion detection evaluation. Proceedings of the DARPA Information Survivability Conference and Exposition (DISCEX’00), Hilton Head, SC, USA.
12. KDD Cup 99 data sets: A perspective on the role of data sets in network intrusion detection research10.1109/MC.2018.2888764 ↗
13. A review of KDD99 dataset usage in intrusion detection and machine learning between 2010 and 2015
14. Luo, C., Wang, L., and Lu, H. (2018, January 8–10). Analysis of LSTM-RNN based on attack type of kdd-99 dataset. Proceedings of the International Conference on Cloud Computing and Security, Haikou, China.10.1007/978-3-030-00006-6_29 ↗
15. (2021, May 10). Fukuda Lab Mawi Archive. Available online: https://fukuda-lab.org/mawilab.
16. Fontugne, R., Borgnat, P., Abry, P., and Fukuda, K. (December, January 30). Mawilab: Combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking. Proceedings of the Co-NEXT ’10: Conference on Emerging Networking EXperiments and Technologies, Philadelphia, PA, USA.
17. Hafsa, M., and Jemili, F. (2019). Comparative study between big data analysis techniques in intrusion detection. Big Data Cogn. Comput., 3.10.3390/bdcc3010001 ↗
18. Kim, J., Sim, C., and Choi, J. (2019, January 25). Generating labeled flow data from MAWILab traces for network intrusion detection. Proceedings of the ACM Workshop on Systems and Network Telemetry and Analytics, Phoenix, AZ, USA.10.1145/3322798.3329251 ↗
19. (2021, May 10). CAIDA Datasets. Available online: https://www.caida.org/catalog/datasets/completed-datasets/.
20. Jonker, M., King, A., Krupp, J., Rossow, C., Sperotto, A., and Dainotti, A. (2017, January 1–3). Millions of targets under attack: A macroscopic characterization of the DoS ecosystem. Proceedings of the 2017 Internet Measurement Conference, London, UK.10.1145/3131365.3131383 ↗
21. At home and abroad: The use of denial-of-service attacks during elections in nondemocratic regimes10.1177/0022002719861676 ↗
22. Hinze, N., Nawrocki, M., Jonker, M., Dainotti, A., Schmidt, T.C., and Wählisch, M. (2018, January 20–25). On the potential of BGP flowspec for DDoS mitigation at two sources: ISP and IXP. Proceedings of the ACM SIGCOMM 2018 Conference on Posters and Demos, Budapest, Hungary.10.1145/3234200.3234209 ↗
23. The DNS in IoT: Opportunities, Risks, and Challenges10.1109/MIC.2020.3005388 ↗
24. Barbosa, R.R.R., Sadre, R., Pras, A., and van de Meent, R. (2010). Simpleweb/University of Twente Traffic Traces Data Repository, Centre for Telematics and Information Technology, University of Twente.
25. Haas, S. (2020). Security Monitoring and Alert Correlation for Network Intrusion Detection. [Ph.D. Thesis, Staats-und Universitätsbibliothek Hamburg Carl von Ossietzky].
26. Botnet detection based on anomaly and community detection10.1109/TCNS.2016.2532804 ↗
27. Čermák, M., and Čeleda, P. (2016, January 20–23). Detecting Advanced Network Threats Using a Similarity Search. Proceedings of the IFIP International Conference on Autonomous Infrastructure, Management and Security, Munich, Germany.10.1007/978-3-319-39814-3_14 ↗
28. Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A.A. (2009, January 8–10). A detailed analysis of the KDD CUP 99 data set. Proceedings of the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, Ottawa, ON, Canada.10.1109/CISDA.2009.5356528 ↗
29. Liu, J., Kantarci, B., and Adams, C. (2020, January 13). Machine learning-driven intrusion detection for contiki-NG-based IoT networks exposed to NSL-KDD dataset. Proceedings of the 2nd ACM Workshop on Wireless Security and Machine Learning, Linz, Austria.10.1145/3395352.3402621 ↗
30. A distributed network intrusion detection system for distributed denial of service attacks in vehicular ad hoc network10.1109/ACCESS.2019.2948382 ↗
31. BAT: Deep learning methods on network intrusion detection using NSL-KDD dataset10.1109/ACCESS.2020.2972627 ↗
32. Ding, Y., and Zhai, Y. (2018, January 8–10). Intrusion detection system for NSL-KDD dataset using convolutional neural networks. Proceedings of the 2018 2nd International Conference on Computer Science and Artificial Intelligence, Shenzhen, China.10.1145/3297156.3297230 ↗
33. Zhang, C., Ruan, F., Yin, L., Chen, X., Zhai, L., and Liu, F. (2019, January 25–27). A deep learning approach for network intrusion detection based on NSL-KDD dataset. Proceedings of the 2019 IEEE 13th International Conference on Anti-Counterfeiting, Security, and Identification (ASID), Xiamen, China.10.1109/ICASID.2019.8925239 ↗
34. (2021, May 10). IMPACT Cyber Trust. Available online: https://www.impactcybertrust.org/.
35. (2021, May 10). UMass Trace Repository. Available online: http://traces.cs.umass.edu/index.php/Network/Network.
36. Nasr, M., Bahramali, A., and Houmansadr, A. (2018, January 15–19). Deepcorr: Strong flow correlation attacks on tor using deep learning. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Toronto, ON, Canada.10.1145/3243734.3243824 ↗
37. Forensic identification of anonymous sources in oneswarm10.1109/TDSC.2015.2497706 ↗
38. Reality mining: Sensing complex social systems10.1007/s00779-005-0046-3 ↗
39. (2021, May 10). Kyoto Dataset. Available online: http://www.takakura.com/Kyoto_data.
40. Song, J., Takakura, H., Okabe, Y., Eto, M., Inoue, D., and Nakao, K. (2011, January 10). Statistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation. Proceedings of the First Workshop on Building Analysis Datasets and Gathering Experience Returns for Security, Salzburg, Austria.10.1145/1978672.1978676 ↗
41. Flower pollination algorithm for feature analysis of kyoto 2006+ data set
42. Dimensionality reduction with IG-PCA and ensemble classifier for network intrusion detection10.1016/j.comnet.2018.11.010 ↗
43. Zuech, R., Khoshgoftaar, T., Seliya, N., Najafabadi, M., and Kemp, C. (2021, April 30). A New Intrusion Detection Benchmarking System. Available online: https://www.aaai.org/ocs/index.php/FLAIRS/FLAIRS15/paper/view/10368.
44. Krystosek, P., Ott, N.M., Sanders, G., and Shimeall, T. (2019). Network Traffic Analysis with SiLK, Carnegie-Mellon Univeristy. Technical Report.
45. (2021, May 10). Snort IDS. Available online: https://snort.org/.
46. Rajagopal, S., Hareesha, K.S., and Kundapur, P.P. (2020). Feature Relevance Analysis and Feature Reduction of UNSW NB-15 Using Neural Networks on MAMLS. Advanced Computing and Intelligent Engineering, Springer.10.1007/978-981-15-1081-6_27 ↗
47. Performance Analysis of Intrusion Detection Systems Using a Feature Selection Method on the UNSW-NB15 Dataset10.1186/s40537-020-00379-6 ↗
48. Kumar, V., Das, A.K., and Sinha, D. (2020). Statistical analysis of the UNSW-NB15 dataset for intrusion detection. Computational Intelligence in Pattern Recognition, Springer.10.1007/978-981-13-9042-5_24 ↗
49. Rajagopal, S., Kundapur, P.P., and Hareesha, K.S. (2020). A stacking ensemble for network intrusion detection using heterogeneous datasets. Secur. Commun. Netw., 2020.10.1155/2020/4586875 ↗
50. Radhakrishnan, C., Karthick, K., and Asokan, R. (2020, January 18–19). Ensemble Learning based Network Anomaly Detection using Clustered Generalization of the Features. Proceedings of the 2020 2nd International Conference on Advances in Computing, Communication Control and Networking (ICACCCN), Greater Noida, India.10.1109/ICACCCN51052.2020.9362791 ↗
51. Yilmaz, I., Masum, R., and Siraj, A. (2020, January 11–13). Addressing imbalanced data problem with generative adversarial network for intrusion detection. Proceedings of the 2020 IEEE 21st International Conference on Information Reuse and Integration for Data Science (IRI), Las Vegas, NV, USA.10.1109/IRI49571.2020.00012 ↗
52. Towards a reliable intrusion detection benchmark dataset
53. Lashkari, A.H., Draper-Gil, G., Mamun, M.S.I., and Ghorbani, A.A. (2017, January 19–21). Characterization of tor traffic using time based features. Proceedings of the 3rd International Conference on Information Systems Security and Privacy, Porto, Portugal.
54. Kshirsagar, D., and Kumar, S. (2021). An efficient feature reduction method for the detection of DoS attack. ICT Express.10.1016/j.icte.2020.12.006 ↗
55. An ensemble feature reduction method for web-attack detection10.1080/09720529.2020.1721861 ↗
56. An enhanced anomaly detection in web traffic using a stack of classifier ensemble10.1109/ACCESS.2020.2969428 ↗
57. Improving AdaBoost-based Intrusion Detection System (IDS) Performance on CIC IDS 2017 Dataset10.1088/1742-6596/1192/1/012018 ↗
58. CICIDS-2017 dataset feature analysis with information gain for anomaly detection10.1109/ACCESS.2020.3009843 ↗
59. On generating network traffic datasets with synthetic attacks for intrusion detection10.1145/3424155 ↗
60. Are public intrusion datasets fit for purpose characterising the state of the art in intrusion event datasets10.1016/j.cose.2020.102022 ↗
61. Realistic Network Traffic Profile Generation: Theory and Practice
62. (2021, May 14). Selenium Python. Available online: https://selenium-python.readthedocs.io.
63. (2021, May 14). Alexa. Available online: https://www.alexa.com.
64. (2021, May 14). Daniel Miessler 10k Most Common Credentials. Available online: https://github.com/danielmiessler.
65. (2021, April 30). Droopescan. Available online: https://github.com/droope/droopescan.
66. (2021, April 30). Joomscan. Available online: https://github.com/OWASP/joomscan/releases.
67. Prefix-preserving IP address anonymization: Measurement-based security evaluation and a new cryptography-based scheme10.1016/j.comnet.2004.03.033 ↗
68. Ferriyan, A., Thamrin, A.H., Takeda, K., and Murai, J. (2021). HIKARI-2021: Generating Network Intrusion Detection Dataset Based on Real and Encrypted Synthetic Attack Traffic, Zenodo.10.3390/app11177868 ↗