SSH Username Enumeration Attack Detection Dataset

The dataset is collected from a closed-environment network using network monitoring tools installed in the data collection point. The dataset generation was achieved through the use of common vulnerabilities and exposures (CVE) with the identification number CVE-2018-15473 retrieved from the public exploits database and pcap file of normal traffic obtained from public training repository. A total of 36,273 instances were collected with two classes <em>“username enumeration attack”</em> and “<em>non-username enumeration</em>”. We chose the terms <em>“username enumeration attack”</em> and “<em>non-username enumeration</em>” instead of the traditional <em>“attack”</em> and <em>“normal”</em> label notations since <em>“</em>normal<em>”</em> traffic data could contain attacks other than username enumeration attack. The username enumeration attack corresponds to the attack traffic while non-username enumeration traffic corresponds to the normal traffic. This traffic reflects different services including emails, DNS, HTTP, web, few to mention. Several data preprocessing techniques were carried out including categorical encoding. Both label encoding and one hot encoding techniques were used to transform categorical feature values into numerical feature values. Hence, two types of datasets were generated.