Error Prevalence in NIDS datasets: A Case Study on CIC-IDS-2017 and CSE-CIC-IDS-2018

Liu, Lisa; Engelen, Gints; Lynar, Timothy; Essam, Daryl; Joosen, Wouter

doi:10.1109/cns56114.2022.9947235

Cited by 27 publications

(7 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In fact, we split and labeled the PCAP data based on the attack paths, attack times, and other information from official documents, rather than the CSV files provided. According to our analysis, we found some issues that are consistent with the findings of Liu (2022) [41]. For example, in CSE-CIC-IDS2018, the execution description of BruteForce FTP can not be matched with the PCAP data, so we removed it from the attack list.…”

Section: Dataset and Experimental Setupsupporting

confidence: 78%

See 1 more Smart Citation

End-to-End Network Intrusion Detection Based on Contrastive Learning

Li,

Lu,

Yang

et al. 2024

Sensors

View full text Add to dashboard Cite

The network intrusion detection system (NIDS) plays a crucial role as a security measure in addressing the increasing number of network threats. The majority of current research relies on feature-ready datasets that heavily depend on feature engineering. Conversely, the increasing complexity of network traffic and the ongoing evolution of attack techniques lead to a diminishing distinction between benign and malicious network behaviors. In this paper, we propose a novel end-to-end intrusion detection framework based on a contrastive learning approach. We design a hierarchical Convolutional Neural Network (CNN) and Gated Recurrent Unit (GRU) model to facilitate the automated extraction of spatiotemporal features from raw traffic data. The integration of contrastive learning amplifies the distinction between benign and malicious network traffic in the representation space. The proposed method exhibits enhanced detection capabilities for unknown attacks in comparison to the approaches trained using the cross-entropy loss function. Experiments are carried out on the public datasets CIC-IDS2017 and CSE-CIC-IDS2018, demonstrating that our method can attain a detection accuracy of 99.9% for known attacks, thus achieving state-of-the-art performance. For unknown attacks, a weighted recall rate of 95% can be achieved.

show abstract

Section: Dataset and Experimental Setupsupporting

confidence: 78%

“…Liu et al analyzed the errors [41] present in both datasets. They analyzed the inconsistency of the dataset labels with the actual attack behavior and provided a modified dataset.…”

Section: Dataset and Experimental Setupmentioning

confidence: 99%

End-to-End Network Intrusion Detection Based on Contrastive Learning

Li,

Lu,

Yang

et al. 2024

Sensors

View full text Add to dashboard Cite

show abstract

“…Kin et al [11] developed a Convolutional Neural Network based model for the detection of DDoS attacks using the KDD [12] and CSE-CIC-IDS 2018 [13] datasets. Focusing on improving intrusion detection systems, the study addressed the challenge of distinguishing DoS attacks, including advanced types, from benign traffic.…”

Section: Related Work a Machine Learning In Ddos Detectionmentioning

confidence: 99%

Open-Set Recognition in Unknown DDoS Attacks Detection With Reciprocal Points Learning

Shieh,

Ho,

Horng

et al. 2024

IEEE Access

View full text Add to dashboard Cite

The internet, a cornerstone of modern life, has profound implications across personal, business, and society. However, its widespread use has posed challenges, especially concerning privacy and cybersecurity. Besides, the threats on the internet are increasing in terms of danger, intensity, and complexity. Distributed denial-of-service (DDoS) attacks have emerged as a common and dangerous cybersecurity threat capable of disabling the network systems of targeted organizations and services. Therefore, various security strategies, such as firewalls and intrusion detection systems (IDS), are employed to protect against DDoS attacks. Enhancing the defensive capabilities of IDS systems through machine learning (ML) and deep learning (DL) technologies is a significant trend nowadays. However, despite notable successes, detecting DDoS attacks using ML and DL technologies still faces challenges, especially with Unknown DDoS Attacks. In this research, the primary goal is to address the unknown DDoS detection problem through efficient and advanced techniques. Our proposed method, CNN-RPL, integrates Convolutional Neural Network (CNN) with Residual Point Learning (RPL), a novel Open-Set Recognition (OSR) technology. This model can effectively handle both known and unknown attacks. The CNN-RPL model demonstrates excellent results, achieving an accuracy exceeding 99.93% against known attacks in the CICIDS2017 dataset. Simultaneously, the model achieves a commendable average accuracy of up to 98.51% against unknown attacks in the CICD-DoS2019 dataset. In particular, the CNN-RPL model simplifies the architecture of the deep neural network by significantly reducing the number of training parameters without compromising defense capabilities. Therefore, our proposed method is genuinely efficient, particularly flexible, and lightweight compared to traditional methods. This can equip organizations and businesses with a highly applicable yet powerful security approach against the evolving complexities in the network space.

show abstract

“…However, this approach proves to be inefficient as it requires filtering the output CSV files N times, with N being the line number of the public tabular data. Moreover, it is worth noting that some errors have been identified in certain public tabular datasets [32,33] recently, further complicating the efficiency and reliability of this method.…”

Section: Flow Construction and Labeling Modulementioning

confidence: 99%

Learn-IDS: Bridging Gaps between Datasets and Learning-Based Network Intrusion Detection

Wang,

Yang,

Guo

et al. 2024

Electronics

View full text Add to dashboard Cite

In an era marked by the escalating architectural complexity of the Internet, network intrusion detection stands as a pivotal element in cybersecurity. This paper introduces Learn-IDS, an innovative framework crafted to bridge existing gaps between datasets and the training process within deep learning (DL) models for Network Intrusion Detection Systems (NIDS). To elevate conventional DL-based NIDS methods, which are frequently challenged by the evolving cyber threat landscape and exhibit limited generalizability across various environments, Learn-IDS works as a potent and adaptable platform and effectively tackles the challenges associated with datasets used in deep learning model training. Learn-IDS takes advantage of the raw data to address three challenges of existing published datasets, which are (1) the provided tabular format is not suitable for the diversity of DL models; (2) the fixed traffic instances are not suitable for the dynamic network scenarios; (3) the isolated published datasets cannot meet the cross-dataset requirement of DL-based NIDS studies. The data processing results illustrate that the proposed framework can correctly process and label the raw data with an average of 90% accuracy across three published datasets. To demonstrate how to use Learn-IDS for a DL-based NIDS study, we present two simple case studies. The case study on cross-dataset sampling function reports an average of 30.3% OOD accuracy improvement. The case study on data formatting function shows that introducing temporal information can enhance the detection accuracy by 4.1%.The experimental results illustrate that the proposed framework, through the synergistic fusion of datasets and DL models, not only enhances detection precision but also dynamically adapts to emerging threats within complex scenarios.

show abstract

Error Prevalence in NIDS datasets: A Case Study on CIC-IDS-2017 and CSE-CIC-IDS-2018

Cited by 27 publications

References 31 publications

End-to-End Network Intrusion Detection Based on Contrastive Learning

End-to-End Network Intrusion Detection Based on Contrastive Learning

Open-Set Recognition in Unknown DDoS Attacks Detection With Reciprocal Points Learning

Learn-IDS: Bridging Gaps between Datasets and Learning-Based Network Intrusion Detection

Contact Info

Product

Resources

About