datasets
Training and evaluation data, with the modality, task and licence stated up front. Listed live from the Hugging Face Hub.
CICIDS2017
CICIDS2017 (Unofficial mirror on Hugging Face)
Dataset Summary
This repository provides a mirrored copy of the CICIDS2017 dataset files (PCAPs and accompanying archives) for easier access and reproducibility in ML/security research workflows.
Important: This is not the original distribution. Please refer to the official source for authoritative documentation, updates, and terms.
Source / Origin
Original dataset name: CICIDS2017
Original publisher: Canadian… See the full description on the dataset page: https://huggingface.co/datasets/bencorn/CICIDS2017.cic-ids-2017
CIC-IDS-2017 Dataset
This repository contains the CIC-IDS-2017 dataset with the original PCAPs and the CSVs converted to Parquet format for easier use.
Dataset Structure
Configurations
machine_learning: Contains the flow-based features used for ML training (Converted from MachineLearningCVE CSVs).
traffic_labels: Contains the labelled flows (Converted from TrafficLabelling CSVs). Timestamps have been normalized to UTC.
Raw Data
The pcap/ folder… See the full description on the dataset page: https://huggingface.co/datasets/bvsam/cic-ids-2017.CIC-IDS2017We have developed a Python package as a wrapper around Hugging Face Hub and Hugging Face Datasets library to access this dataset easily.
NIDS Datasets
The nids-datasets package provides functionality to download and utilize specially curated and extracted datasets from the original UNSW-NB15 and CIC-IDS2017 datasets. These datasets, which initially were only flow datasets, have been enhanced to include packet-level information from the raw PCAP files. The dataset contains both… See the full description on the dataset page: https://huggingface.co/datasets/rdpahalavan/CIC-IDS2017.CIC-IDS2017The CICIDS2017 dataset consists of labeled network flows, including full packet payloads in pcap format, the corresponding profiles and the labeled flows (GeneratedLabelledFlows.zip) and CSV files for machine and deep learning purpose (MachineLearningCSV.zip) are publicly available for researchers. If you are using our dataset, you should cite our related paper which outlining the details of the dataset and its underlying principles:
Iman Sharafaldin, Arash Habibi Lashkari, and Ali A.… See the full description on the dataset page: https://huggingface.co/datasets/c01dsnap/CIC-IDS2017.CICIDS2017
CICIDS2017 Network Intrusion Detection Dataset
The CICIDS2017 dataset from the Canadian Institute for Cybersecurity, provided with temporal and random splits for fair evaluation.
Configurations
temporal (default) — Day-Based Temporal Split
Note: standard is an alias for temporal — both load the same data.
Train on Monday-Thursday, test on Friday. The model must generalize to unseen attack types (DDoS, Botnet, PortScan).
from datasets import load_dataset
ds =… See the full description on the dataset page: https://huggingface.co/datasets/lacg030175/CICIDS2017.cic-ids-2017
CIC-IDS-2017 Dataset
This repository contains the CIC-IDS-2017 dataset with the original PCAPs and the CSVs converted to Parquet format for easier use.
Dataset Structure
Configurations
machine_learning: Contains the flow-based features used for ML training (Converted from MachineLearningCVE CSVs).
traffic_labels: Contains the labelled flows (Converted from TrafficLabelling CSVs). Timestamps have been normalized to UTC.
Raw Data
The pcap/ folder… See the full description on the dataset page: https://huggingface.co/datasets/Ariasyah/cic-ids-2017.CICIDS-2017Raw network data was collected over a period of 5 days, Monday through Friday, and stored in PCAP files.
Monday was used to create most of the Benign data, while the Attack-Network implemented various types of attacks over the next 4 days,
such as Brute Force connections (FTP and SSH), several types of DoS attacks, as well as a Botnet attack, Infiltration attacks and subsequent Port-Scanning activity.
The PCAP data was processed using a tool developed by one of the authors of [1], called… See the full description on the dataset page: https://huggingface.co/datasets/bvk/CICIDS-2017.CIC-IDS2017We have developed a Python package as a wrapper around Hugging Face Hub and Hugging Face Datasets library to access this dataset easily.
NIDS Datasets
The nids-datasets package provides functionality to download and utilize specially curated and extracted datasets from the original UNSW-NB15 and CIC-IDS2017 datasets. These datasets, which initially were only flow datasets, have been enhanced to include packet-level information from the raw PCAP files. The dataset contains both… See the full description on the dataset page: https://huggingface.co/datasets/veera33/CIC-IDS2017.CIC-IDS-2017We have developed a Python package as a wrapper around Hugging Face Hub and Hugging Face Datasets library to access this dataset easily.
NIDS Datasets
The nids-datasets package provides functionality to download and utilize specially curated and extracted datasets from the original UNSW-NB15 and CIC-IDS2017 datasets. These datasets, which initially were only flow datasets, have been enhanced to include packet-level information from the raw PCAP files. The dataset contains both… See the full description on the dataset page: https://huggingface.co/datasets/pcy12345BSU/CIC-IDS-2017.cicids2017CICIDS-2017CIC-IDS2017The CICIDS2017 dataset consists of labeled network flows, including full packet payloads in pcap format, the corresponding profiles and the labeled flows (GeneratedLabelledFlows.zip) and CSV files for machine and deep learning purpose (MachineLearningCSV.zip) are publicly available for researchers. If you are using our dataset, you should cite our related paper which outlining the details of the dataset and its underlying principles:
Iman Sharafaldin, Arash Habibi Lashkari, and Ali A.… See the full description on the dataset page: https://huggingface.co/datasets/muzom/CIC-IDS2017.CICIDS2017-raw
CICIDS2017 (raw variant)
Companion to lacg030175/CICIDS2017. This variant preserves rows with NaN or ±infinity values in any feature column (the original dataset drops them via pd.dropna). Intended for use with ThermometerEncoder(invalid_encoding="single_bit"), which treats missing / undefined values as a learnable is_invalid flag bit rather than silently encoding them as zero.
Row counts
Full dataset (all days): 2,830,743 rows
Splits:
random (80/20): 2,264,594 train /… See the full description on the dataset page: https://huggingface.co/datasets/lacg030175/CICIDS2017-raw.ids-cicids2017-dataCICIDS-2017-plusCAD-CICIDS2017
CAD-CICIDS2017
Dataset Summary
CAD-CICIDS2017 is a single-source continual anomaly detection benchmark scenario for network intrusion detection. It is derived from CIC-IDS2017 and converts the original tabular network-intrusion data into a sequence of concept-grouped tasks.
The dataset contains 2,076,848 samples, 6 tasks, and has a reported 18.77% anomaly ratio in the test set.
Intended Use
This dataset is intended for research on:
continual… See the full description on the dataset page: https://huggingface.co/datasets/lifelonglab/CAD-CICIDS2017.cic-ids2017cicids2017-ids-dataset
CICIDS2017 IDS Dataset (Cleaned + Topology-Injected)
This dataset is a cleaned and topology-enriched version of the CICIDS2017 intrusion detection dataset.
Details
Total Flows: 1,385,330
Features: 58 numerical features
Attack Classes: 14 raw → 8 unified threat families
Includes: IP topology reconstruction (source/destination IPs mapped from attack labels)
Processing
NaN/Inf/negative value removal
Zero-variance feature drop
Collinearity pruning… See the full description on the dataset page: https://huggingface.co/datasets/transformer112/cicids2017-ids-dataset.cic-ids-2017-flowprep
CIC-IDS-2017 — Canonical NetFlow (flowprep)
A ~101k-row slice of the CIC-IDS-2017 intrusion-detection dataset, normalized
into a single clean, typed, unit-normalized canonical NetFlow parquet table by
flowprep — the open-source flow
canonicalization tool DeepTempo runs in production ahead of inference.
This is a conversion proof-point: it shows what a real, messy research dataset
looks like after flowprep canonicalize resolves its vendor column names, infers
its units, and types… See the full description on the dataset page: https://huggingface.co/datasets/DeepTempo/cic-ids-2017-flowprep.cic-ids-2017
CIC-IDS-2017 Dataset
This repository contains the CIC-IDS-2017 dataset with the original PCAPs and the CSVs converted to Parquet format for easier use.
Dataset Structure
Configurations
machine_learning: Contains the flow-based features used for ML training (Converted from MachineLearningCVE CSVs).
traffic_labels: Contains the labelled flows (Converted from TrafficLabelling CSVs). Timestamps have been normalized to UTC.
Raw Data
The pcap/ folder… See the full description on the dataset page: https://huggingface.co/datasets/renuka1507/cic-ids-2017.Cicids2017_Suricata_LogsCI-CIDS2017cic-ids-2017cic-ids-2017-flowprep
CIC-IDS-2017 Canonical NetFlow Flowprep (TsFile)
This repository contains an Apache TsFile conversion of
DeepTempo/cic-ids-2017-flowprep,
a small CIC-IDS-2017 demonstration slice canonicalized by DeepTempo's
flowprep tool into a typed NetFlow schema.
Modalities: Time-series.
Source Dataset
Original dataset: DeepTempo/cic-ids-2017-flowprep
Source artifact: data/cic-ids-2017-canonical.parquet
Rows: 101,094 flows
Columns: 13 source columns
Task: binary… See the full description on the dataset page: https://huggingface.co/datasets/THULab/cic-ids-2017-flowprep.CIC-IDS2017The CICIDS2017 dataset consists of labeled network flows, including full packet payloads in pcap format, the corresponding profiles and the labeled flows (GeneratedLabelledFlows.zip) and CSV files for machine and deep learning purpose (MachineLearningCSV.zip) are publicly available for researchers. If you are using our dataset, you should cite our related paper which outlining the details of the dataset and its underlying principles:
Iman Sharafaldin, Arash Habibi Lashkari, and Ali A.… See the full description on the dataset page: https://huggingface.co/datasets/ksay1o/CIC-IDS2017.Cic-Ids2017-DiFLCIC-IDS-2017-V2The CIC-IDS-V2 is an extended version of the original CIC-IDS 2017 dataset. The dataset is normalised and 1 new class called "Comb" is added which is a combination of synthesised data of multiple non-benign classes.
To cite the dataset, please reference the original paper with DOI: 10.1109/SmartNets61466.2024.10577645. The paper is published in IEEE SmartNets and can be accessed here:… See the full description on the dataset page: https://huggingface.co/datasets/abluva/CIC-IDS-2017-V2.DATASET_CICIDS2017CICIDS-2017Raw network data was collected over a period of 5 days, Monday through Friday, and stored in PCAP files.
Monday was used to create most of the Benign data, while the Attack-Network implemented various types of attacks over the next 4 days,
such as Brute Force connections (FTP and SSH), several types of DoS attacks, as well as a Botnet attack, Infiltration attacks and subsequent Port-Scanning activity.
The PCAP data was processed using a tool developed by one of the authors of [1], called… See the full description on the dataset page: https://huggingface.co/datasets/vishwa132/CICIDS-2017.CICIDS2017-Images-spectrogramsThis directory consists on 24x24 images
train folder have total 1548421 images from 10 classes
test folder have 663609 images from 10 classes
This Dataset is Spectrogram converted images using method explained in our research article XYZ.
Dataset Used: Intrusion detection evaluation dataset (CIC-IDS2017)
Image Size: 28x28
Classes:
BENIGN
Bot
DDoS
DoS GoldenEye
DoS Hulk
DoS Slowhttptest
DoS slowloris
Heartbleed
Infiltration
PortScan
License:
https://www.unb.ca/cic/datasets/ids-2017.html… See the full description on the dataset page: https://huggingface.co/datasets/rashid-rao/CICIDS2017-Images-spectrograms.