A survey of network-based intrusion detection data sets. Issue 86 (September 2019)

• Record Type: Journal Article
• Authors: Ring, Markus; Wunderlich, Sarah; Scheuring, Deniz; Landes, Dieter; Hotho, Andreas
• Is Part Of: Computers & security. Issue 86(2019)
• Page Start: 147
• Page End: 167
• Publication Date: 2019-09
• Subjects: Intrusion detection -- IDS -- NIDS -- Data sets -- Evaluation -- Data mining; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2019.06.005
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Labeled data sets are necessary to train and evaluate anomaly-based network intrusion detection systems. This work provides a focused literature survey of data sets for network-based intrusion detection and describes the underlying packet- and flow-based network data in detail. The paper identifies 15 different properties to assess the suitability of individual data sets for specific evaluation scenarios. These properties cover a wide range of criteria and are grouped into five categories such as data volume or recording environment for offering a structured search. Based on these properties, a comprehensive overview of existing data sets is given. This overview also highlights the peculiarities of each data set. Furthermore, this work briefly touches upon other sources for network-based data such as traffic generators and data repositories. Finally, we discuss our observations and provide some recommendations for the use and the creation of network-based data sets.