Datasetpublic

lifelonglab/CAD-CICIDS2017

CAD-CICIDS2017 Dataset Summary CAD-CICIDS2017 is a single-source continual anomaly detection benchmark scenario for network intrusion detection. It is derived from CIC-IDS2017 and converts the original tabular network-intrusion data into a sequence of concept-grouped tasks. The dataset contains 2,076,848 samples, 6 tasks, and has a reported 18.77% anomaly ratio in the test set. Intended Use This dataset is intended for research on: continual… See the full description on the dataset page: https://huggingface.co/datasets/lifelonglab/CAD-CICIDS2017.

sourceHugging Facecc-by-4.0updated 1mo agoView on Hugging Face

0likes49downloads

Dataset Card

CAD-CICIDS2017

Dataset Summary

CAD-CICIDS2017 is a single-source continual anomaly detection benchmark scenario for network intrusion detection. It is derived from CIC-IDS2017 and converts the original tabular network-intrusion data into a sequence of concept-grouped tasks.

The dataset contains 2,076,848 samples, 6 tasks, and has a reported 18.77% anomaly ratio in the test set.

Intended Use

This dataset is intended for research on:

—continual anomaly detection;
—continual learning for tabular data;
—network intrusion detection;
—robustness under distribution shift;
—task ordering in continual-learning benchmarks;
—forgetting and knowledge transfer across related network-traffic concepts;
—benchmarking anomaly detectors under sequential task exposure.

The intended use is defensive machine learning research. The dataset should not be used to support offensive cybersecurity activity.

Dataset Source

—CIC-IDS2017: https://www.unb.ca/cic/datasets/ids-2017.html

Dataset Files

The repository contains the following files:

File	Description
`data.csv`	Main tabular dataset file.
`orderings.json`	Predefined task orderings for continual-learning evaluation.
`croissant.json`	Croissant metadata describing the dataset.

Dataset Structure

The main file is:

text

data.csv

The dataset contains task metadata, binary labels, and numerical flow-level features.

Core Columns

Column	Type	Description
`task_id`	integer	Numeric identifier of the continual-learning task.
`task_name`	string	Name of the task, e.g. `cicids2017_0`.
`task_split`	string	Split assignment for the row.
`label`	integer	Binary anomaly label. `0` denotes benign/normal traffic and `1` denotes anomalous/attack traffic.

Task Identifiers

The dataset contains the following task identifiers:

cicids2017_0, cicids2017_1, cicids2017_2, cicids2017_3, cicids2017_4, cicids2017_5

Feature Columns

The remaining columns are numerical network-flow features, including packet-count, byte-count, flag-count, duration, inter-arrival-time, and aggregate flow-statistics features. Representative examples include:

—Destination Port
—Flow Duration
—Flow Bytes/s
—Flow Packets/s
—Total Fwd Packets
—Total Backward Packets
—Total Length of Fwd Packets
—Total Length of Bwd Packets
—Fwd Packet Length Mean
—Bwd Packet Length Mean
—Flow IAT Mean
—Fwd IAT Mean
—Bwd IAT Mean

For the complete schema, see croissant.json.

Task Orderings

The dataset provides six predefined orderings in orderings.json. These orderings define different continual-learning evaluation regimes over the same task set.

Ordering	Task sequence
`curriculum_asc`	`cicids2017_5` → `cicids2017_2` → `cicids2017_0` → `cicids2017_3` → `cicids2017_4` → `cicids2017_1`
`curriculum_desc`	`cicids2017_1` → `cicids2017_4` → `cicids2017_3` → `cicids2017_0` → `cicids2017_2` → `cicids2017_5`
`generalization_desc`	`cicids2017_4` → `cicids2017_3` → `cicids2017_0` → `cicids2017_2` → `cicids2017_5` → `cicids2017_1`
`generalization_asc`	`cicids2017_1` → `cicids2017_5` → `cicids2017_2` → `cicids2017_0` → `cicids2017_3` → `cicids2017_4`
`smooth_drift`	`cicids2017_5` → `cicids2017_1` → `cicids2017_4` → `cicids2017_0` → `cicids2017_2` → `cicids2017_3`
`abrupt_drift`	`cicids2017_4` → `cicids2017_5` → `cicids2017_3` → `cicids2017_1` → `cicids2017_2` → `cicids2017_0`

These orderings are intended to expose complementary continual-learning dynamics, including curriculum-like adaptation, generalization-oriented ordering, smooth drift, and abrupt drift.

Dataset Creation

The details of dataset creation can be found in our paper: link

Citation

When using the dataset, please cite:

@article{faber2026towards,
  title={Towards Principled Continual Anomaly Detection: A Systematic Framework and Benchmark Scenarios},
  author={Faber, Kamil and Smendowski, Mateusz and Corizzo, Roberto},
  journal={arXiv preprint arXiv:2607.18289},
  year={2026}
}