silviocretti/DOS2019_highly_unbalanced

CIC-DDoS2019 Highly Unbalanced (Federated, Pre-Partitioned)

This dataset contains a collection of DDoS attacks. It is a preprocessed, repartitioned derivative of the CIC-DDoS2019 dataset, originally published by the Canadian Institute for Cybersecurity (CIC), University of New Brunswick. More details about the CIC-DDoS2019 dataset can be found on this page and in the following scientific paper:

Iman Sharafaldin, Arash Habibi Lashkari, Saqib Hakak, and Ali A. Ghorbani, "Developing Realistic Distributed Denial of Service (DDoS) Attack Dataset and Taxonomy", IEEE 53rd International Carnahan Conference on Security Technology, Chennai, India, 2019.

This version contains network flows partitioned per attack-type/client_id, converted from HDF5 to Parquet, and consolidated into three splits (train, val, test) for use in FLAD federated learning experiments.

For the federated learning experiments, the dataset is partitioned among 13 clients. Each client is assigned a single attack type together with a portion of the benign traffic, resulting in a non-IID distribution of network flows across clients. This partitioning is designed to reproduce a realistic federated learning setting in which individual clients have access to different attack types while sharing benign traffic.

Dataset structure

Each split (train.parquet - ~80% of the whole dataset, val.parquet - ~10%, test.parquet - ~10%) contains one row per bidirectional network flow sample, with the following columns:

Samples are grouped by client_id, mirroring the original per-client HDF5 directory structure, used in the FLAD experimentation. The original HDF5 structure comprises 13 clients X 3 splits = 39 HDF5 files in the form of arrays of shape n = 10 rows and f = 11 columns. The 11 features are the following:

Time, Packet Length, Highest Protocol, IP Flags, Protocols, TCP Length, TCP Ack, TCP Flags, TCP Window Size, UDP Length and ICMP Type.

Each client contains samples of benign traffic and only one type of attack. Although each group has been balanced to ensure an approximately equal distribution between benign and DDoS samples, the partition across groups/clients is strongly non-i.i.d since each one represents a single attack type.

Related Work

This dataset has been used in:

Roberto Doriguzzi-Corin, and Domenico Siracusa, "FLAD: Adaptive Federated Learning for DDoS attack detection". Computers & Security 137 (2024): 103597.