Datasetpublic

lifelonglab/MCAD-CIC-3x1

MCAD-CIC-3x1 Dataset Summary MCAD-CIC-3x1 is a multi-source continual anomaly detection benchmark scenario for network intrusion detection. It combines three CIC-family source datasets into a three-task continual-learning scenario: cicids2017 cicids2018 cicunsw Each task corresponds to one consolidated source dataset. The benchmark is designed to evaluate continual anomaly detection methods under cross-source distribution shift. The dataset contains 17,915,569… See the full description on the dataset page: https://huggingface.co/datasets/lifelonglab/MCAD-CIC-3x1.

sourceHugging Facecc-by-4.0updated 1mo agoView on Hugging Face

0likes25downloads

Dataset Card

MCAD-CIC-3x1

Dataset Summary

MCAD-CIC-3x1 is a multi-source continual anomaly detection benchmark scenario for network intrusion detection. It combines three CIC-family source datasets into a three-task continual-learning scenario:

1.cicids2017
2.cicids2018
3.cicunsw

Each task corresponds to one consolidated source dataset. The benchmark is designed to evaluate continual anomaly detection methods under cross-source distribution shift.

The dataset contains 17,915,569 samples and has a reported 10.42% anomaly ratio in the test set.

Intended Use

This dataset is intended for research on:

—continual anomaly detection;
—continual learning for tabular data;
—network intrusion detection;
—robustness under distribution shift;
—forgetting and knowledge transfer across tabular anomaly detection datasets;
—benchmarking anomaly detectors under sequential task exposure.

The intended use is defensive machine learning research. The dataset should not be used to support offensive cybersecurity activity.

Dataset Sources

MCAD-CIC-3x1 is derived from the following source datasets:

—CIC-IDS2017: https://www.unb.ca/cic/datasets/ids-2017.html
—CIC-IDS2018: https://www.unb.ca/cic/datasets/ids-2018.html
—CIC-UNSW-NB15: https://www.unb.ca/cic/datasets/cic-unsw-nb15.html

The dataset contains aggregated flow-level tabular features derived from network traffic. Source and destination IP addresses and packet payloads are excluded during preprocessing.

Dataset Files

The repository contains the following files:

File	Description
`data.csv`	Main tabular dataset file.
`orderings.json`	Predefined task orderings for continual-learning evaluation.
`croissant.json`	Croissant metadata describing the dataset.
`data_sampled.csv`	Lightweight sampled subset for inspection.
`data_sampled_readme.txt`	Description of the sampled subset.

The sampled file is a balanced random sample of up to 1000 rows per task_id.

Dataset Structure

The main file is:

text

mcad-cic-3x1.csv

The dataset contains task metadata, binary labels, and numerical flow-level features.

Core Columns

Column	Type	Description
`task_id`	integer	Numeric identifier of the continual-learning task.
`task_name`	string	Name of the task/source dataset, e.g. `cicids2017`, `cicids2018`, or `cicunsw`.
`task_split`	string	Split assignment for the row.
`label`	integer	Binary anomaly label. `0` denotes benign/normal traffic and `1` denotes anomalous/attack traffic.

Feature Columns

The remaining columns are numerical network-flow features, including packet-count, byte-count, flag-count, duration, inter-arrival-time, and aggregate flow-statistics features. Representative examples include:

—Flow Duration
—Flow Bytes/s
—Flow Packets/s
—Total Fwd Packets
—Total Backward Packets
—Total Length of Fwd Packets
—Total Length of Bwd Packets
—Fwd Packet Length Mean
—Bwd Packet Length Mean
—Packet Length Mean
—Packet Length Std
—SYN Flag Count
—ACK Flag Count
—RST Flag Count
—Destination Port

For the complete schema, see croissant.json.

Task Orderings

The dataset provides six predefined orderings in orderings.json. These orderings define different continual-learning evaluation regimes over the same three tasks.

Ordering	Task sequence
`curriculum_asc`	`cicunsw` → `cicids2017` → `cicids2018`
`curriculum_desc`	`cicids2018` → `cicids2017` → `cicunsw`
`gen_paper_desc`	`cicids2018` → `cicunsw` → `cicids2017`
`gen_paper_asc`	`cicids2017` → `cicunsw` → `cicids2018`
`smooth_drift`	`cicids2018` → `cicids2017` → `cicunsw`
`abrupt_drift`	`cicids2017` → `cicids2018` → `cicunsw`

These orderings are intended to expose complementary continual-learning dynamics, including curriculum-like adaptation, generalization-oriented ordering, smooth drift, and abrupt drift.

Dataset Creation

The details of dataset creation can be found in our paper: link

Citation

When using the dataset, please cite:

@article{faber2026towards,
  title={Towards Principled Continual Anomaly Detection: A Systematic Framework and Benchmark Scenarios},
  author={Faber, Kamil and Smendowski, Mateusz and Corizzo, Roberto},
  journal={arXiv preprint arXiv:2607.18289},
  year={2026}
}