CoolFace
Datasetpublic

lacg030175/CICIDS2017

CICIDS2017 Network Intrusion Detection Dataset The CICIDS2017 dataset from the Canadian Institute for Cybersecurity, provided with temporal and random splits for fair evaluation. Configurations temporal (default) — Day-Based Temporal Split Note: standard is an alias for temporal — both load the same data. Train on Monday-Thursday, test on Friday. The model must generalize to unseen attack types (DDoS, Botnet, PortScan). from datasets import… See the full description on the dataset page: https://huggingface.co/datasets/lacg030175/CICIDS2017.

sourceHugging Facecc-by-4.0updated 6mo agoView on Hugging Face
0likes333downloads
Dataset Card

CICIDS2017 Network Intrusion Detection Dataset

The CICIDS2017 dataset from the Canadian Institute for Cybersecurity, provided with temporal and random splits for fair evaluation.

Configurations

temporal (default) — Day-Based Temporal Split

Note: standard is an alias for temporal — both load the same data.

Train on Monday-Thursday, test on Friday. The model must generalize to unseen attack types (DDoS, Botnet, PortScan).

python
from datasets import load_dataset
ds = load_dataset("lacg030175/CICIDS2017", "temporal")  # or "standard"
# ds["train"]: 2,125,158 rows (Mon-Thu)
# ds["test"]:  702,718 rows (Friday)

Train attacks: 267,771 / 2,125,158 (12.6%) Test attacks: 288,785 / 702,718 (41.1%)

random — Stratified Random Split

80/20 stratified random split from all days combined.

python
ds = load_dataset("lacg030175/CICIDS2017", "random")
# ds["train"]: 2,262,300 rows
# ds["test"]:  565,576 rows

Top-20 RF Features

  1. 1.Bwd Packet Length Std
  2. 2.Destination Port
  3. 3.Packet Length Std
  4. 4.Bwd Packet Length Max
  5. 5.Avg Bwd Segment Size
  6. 6.Bwd Packet Length Mean
  7. 7.Fwd IAT Std
  8. 8.Average Packet Size
  9. 9.Packet Length Variance
  10. 10.Flow IAT Max
  11. 11.Packet Length Mean
  12. 12.InitWinbytes_forward
  13. 13.Idle Min
  14. 14.Idle Mean
  15. 15.Fwd IAT Max
  16. 16.Flow IAT Std
  17. 17.Flow Packets/s
  18. 18.Flow IAT Mean
  19. 19.Fwd Header Length
  20. 20.Bwd Header Length

Attack Types

DayAttack Types
MondayBenign only
TuesdayFTP-Patator, SSH-Patator
WednesdayDoS Hulk, DoS GoldenEye, DoS Slowhttptest, DoS slowloris, Heartbleed
ThursdayWeb Attack (Brute Force, XSS, SQL Injection), Infiltration
Friday (test)Bot, DDoS, PortScan

Labels

  • —Binary (label): 0 = BENIGN, 1 = Attack
  • —Multi-class (Label): 15 categories (BENIGN + 14 attack types)

Features

78 numeric flow-level features extracted by CICFlowMeter.

Preprocessing

  • —Removed rows with NaN/infinity values
  • —Stripped whitespace from column names and labels
  • —All features converted to numeric (float64)
  • —Added binary label column (0=BENIGN, 1=Attack)

Citation

bibtex
@inproceedings{sharafaldin2018toward,
  title={Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization},
  author={Sharafaldin, Iman and Lashkari, Arash Habibi and Ghorbani, Ali A},
  booktitle={International Conference on Information Systems Security and Privacy},
  year={2018}
}

License

CC BY 4.0 — original dataset by the Canadian Institute for Cybersecurity, University of New Brunswick.