Time Series Dataset For DDOS(TSD-DDoS) Attack Detection

Distributed Denial of Service (DDoS) attacks first appeared in the mid-1990s, as attacks stopping legitimate users from accessing specific services available on the Internet. A DDoS attack attempts to exhaust the resources of the victim to crash or suspend its services. Time series modeling will help system administrators for better planning of resource allocation to defend against DDoS attacks. Different Time Series analysis techniques are applied to detect the DDoS attacks. This time series data set is prepared by processing the pcap files present in the benchmark data set CICDDoS2019. The CICDDoS2019 dataset has numerous modern reflective DDoS attacks, such as PortMap, NetBIOS, LDAP, MSSQL, UDP, UDP-Lag, SYN, NTP, DNS, and SNMP. The training day on 12 January began at 10:30 and ended at 17:15, and the test day on 11 March started at 09:40 and ended at 17:35.We replayed the CICDDoS2019 dataset pcap files using the tool tcpreplay at different network speeds up to 20 Gbps and captured the traffic using the tool Wireshark. We captured network traffic for every time interval(5 Seconds) as a separate pcap file and processed it to produce the feature score for every time interval.This data set will help in detecting TCP-based flooding attacks, namely TCP-SYN, TCP-SYN-ACK, TCP-ACK, and TCP-RST.

分布式拒绝服务（DDoS）攻击首次于20世纪90年代中期出现，其旨在阻止合法用户访问互联网上特定服务的攻击手段。DDoS攻击试图耗尽受害者的资源，使其服务崩溃或暂停。时间序列建模有助于系统管理员更好地规划资源分配，以防御DDoS攻击。不同的时间序列分析方法被应用于检测DDoS攻击。本时间序列数据集通过处理基准数据集CICDDoS2019中的pcap文件而制备。CICDDoS2019数据集包含了众多现代反射型DDoS攻击，例如PortMap、NetBIOS、LDAP、MSSQL、UDP、UDP-Lag、SYN、NTP、DNS以及SNMP等。1月12日的训练日从10:30开始，至17:15结束，3月11日的测试日从09:40开始，至17:35结束。我们使用tcpreplay工具以不同的网络速度（高达20 Gbps）重新播放了CICDDoS2019数据集的pcap文件，并使用Wireshark工具捕获了流量。我们将每个时间间隔（5秒）的网络流量捕获为单独的pcap文件，并对其进行处理以生成每个时间间隔的特征得分。此数据集有助于检测基于TCP的洪水攻击，即TCP-SYN、TCP-SYN-ACK、TCP-ACK和TCP-RST攻击。