Datasetpublic

anonymizeddb/MCAD-CIC-3xN

MCAD-CIC-3xN Dataset Summary MCAD-CIC-3xN is a multi-source continual anomaly detection benchmark scenario for network intrusion detection. It combines three CIC-family source datasets into a 13-task continual-learning scenario: CIC-IDS2017-derived tasks; CIC-IDS2018-derived tasks; CIC-UNSW-NB15-derived tasks. Unlike a single-task-per-source construction, this benchmark provides multiple concept-grouped tasks per source dataset. It is intended to evaluate… See the full description on the dataset page: https://huggingface.co/datasets/anonymizeddb/MCAD-CIC-3xN.

sourceHugging Facecc-by-4.0updated 5mo agoView on Hugging Face

0likes34downloads

Dataset Card

MCAD-CIC-3xN

Dataset Summary

MCAD-CIC-3xN is a multi-source continual anomaly detection benchmark scenario for network intrusion detection. It combines three CIC-family source datasets into a 13-task continual-learning scenario:

1.CIC-IDS2017-derived tasks;
2.CIC-IDS2018-derived tasks;
3.CIC-UNSW-NB15-derived tasks.

Unlike a single-task-per-source construction, this benchmark provides multiple concept-grouped tasks per source dataset. It is intended to evaluate continual anomaly detection methods under both intra-source task variation and cross-source distribution shift.

The dataset contains 3,581,792 samples, 13 tasks, and has a reported 27.36% anomaly ratio in the test set.

The dataset is anonymized for double-blind NeurIPS review. Author names, institutional affiliations, project acknowledgements, and non-anonymous paper references are intentionally omitted.

Intended Use

This dataset is intended for research on:

—continual anomaly detection;
—continual learning for tabular data;
—network intrusion detection;
—robustness under distribution shift;
—task ordering in continual-learning benchmarks;
—forgetting and knowledge transfer across anomaly detection datasets;
—benchmarking anomaly detectors under sequential task exposure.

The intended use is defensive machine learning research. The dataset should not be used to support offensive cybersecurity activity.

Dataset Sources

MCAD-CIC-3xN is derived from the following source datasets:

—CIC-IDS2017: https://www.unb.ca/cic/datasets/ids-2017.html
—CIC-IDS2018: https://www.unb.ca/cic/datasets/ids-2018.html
—CIC-UNSW-NB15: https://www.unb.ca/cic/datasets/cic-unsw-nb15.html

Dataset Files

The repository contains the following files:

File	Description
`data.csv`	Main tabular dataset file.
`orderings.json`	Predefined task orderings for continual-learning evaluation.
`croissant.json`	Croissant metadata describing the dataset.

Dataset Structure

The main file is:

text

data.csv

The dataset contains task metadata, binary labels, and numerical flow-level features.

Core Columns

Column	Type	Description
`task_id`	integer	Numeric identifier of the continual-learning task.
`task_name`	string	Name of the task, e.g. `cicids2017_0`, `cicids2018_2`, or `cicunsw_3`.
`task_split`	string	Split assignment for the row.
`label`	integer	Binary anomaly label. `0` denotes benign/normal traffic and `1` denotes anomalous/attack traffic.

Task Identifiers

The 13 tasks are grouped by source dataset:

Source group	Task identifiers
CIC-IDS2017	`cicids2017_0`, `cicids2017_1`, `cicids2017_2`, `cicids2017_3`, `cicids2017_4`
CIC-IDS2018	`cicids2018_0`, `cicids2018_1`, `cicids2018_2`, `cicids2018_3`
CIC-UNSW-NB15	`cicunsw_0`, `cicunsw_1`, `cicunsw_2`, `cicunsw_3`

Feature Columns

The remaining columns are numerical network-flow features, including packet-count, byte-count, flag-count, duration, inter-arrival-time, and aggregate flow-statistics features. Representative examples include:

—Flow Duration
—Flow Bytes/s
—Flow Packets/s
—Total Fwd Packets
—Total Backward Packets
—Total Length of Fwd Packets
—Total Length of Bwd Packets
—Fwd Packet Length Mean
—Bwd Packet Length Mean
—Packet Length Mean
—Packet Length Std
—Packet Length Variance
—SYN Flag Count
—ACK Flag Count
—RST Flag Count
—PSH Flag Count
—Destination Port

For the complete schema, see croissant.json.

Task Orderings

The dataset provides six predefined orderings in orderings.json. These orderings define different continual-learning evaluation regimes over the same 13 tasks.

Ordering	Task sequence
`curriculum_asc`	`cicunsw_3` → `cicids2017_1` → `cicids2017_4` → `cicids2017_0` → `cicunsw_1` → `cicids2017_2` → `cicids2018_2` → `cicids2017_3` → `cicunsw_0` → `cicunsw_2` → `cicids2018_3` → `cicids2018_1` → `cicids2018_0`
`curriculum_desc`	`cicids2018_0` → `cicids2018_1` → `cicids2018_3` → `cicunsw_2` → `cicunsw_0` → `cicids2017_3` → `cicids2018_2` → `cicids2017_2` → `cicunsw_1` → `cicids2017_0` → `cicids2017_4` → `cicids2017_1` → `cicunsw_3`
`generalization_desc`	`cicunsw_3` → `cicunsw_1` → `cicunsw_0` → `cicids2017_4` → `cicunsw_2` → `cicids2018_0` → `cicids2018_2` → `cicids2017_1` → `cicids2018_1` → `cicids2017_3` → `cicids2017_2` → `cicids2017_0` → `cicids2018_3`
`generalization_asc`	`cicids2018_3` → `cicids2017_0` → `cicids2017_2` → `cicids2017_3` → `cicids2018_1` → `cicids2017_1` → `cicids2018_2` → `cicids2018_0` → `cicunsw_2` → `cicids2017_4` → `cicunsw_0` → `cicunsw_1` → `cicunsw_3`
`smooth_drift`	`cicids2018_2` → `cicids2018_3` → `cicunsw_0` → `cicids2018_1` → `cicids2017_4` → `cicunsw_1` → `cicunsw_3` → `cicunsw_2` → `cicids2018_0` → `cicids2017_0` → `cicids2017_3` → `cicids2017_1` → `cicids2017_2`
`abrupt_drift`	`cicunsw_0` → `cicids2017_2` → `cicunsw_3` → `cicids2017_1` → `cicunsw_2` → `cicids2018_2` → `cicids2017_4` → `cicids2017_0` → `cicunsw_1` → `cicids2017_3` → `cicids2018_1` → `cicids2018_3` → `cicids2018_0`

These orderings are intended to expose complementary continual-learning dynamics, including curriculum-like adaptation, generalization-oriented ordering, smooth drift, and abrupt drift.