CICIDS2017-DOS (MB)

CICIDS2017-DOS (MB) represents the moderately balanced version of the DoS-specific subset derived from the CICIDS2017 dataset. This version maintains all six traffic categories found in the PB dataset, including benign traffic and the five DoS attack types: DDoS, DoS GoldenEye, DoS Hulk, DoS Slowloris, and DoS SlowHTTPTest. Unlike the perfectly balanced distribution in the PB dataset, the MB dataset follows the default behaviour of the TUNE sampling framework, where majority classes are reduced to approximately twice the median class size, while minority classes are moderately increased only when needed. This produces a structured but naturally uneven distribution where attack categories remain present in meaningful proportions without full equalization.

All preprocessing steps used in constructing the PB dataset were also applied here, including feature reduction, cleaning, and converting categorical attributes to numeric format. The resulting dataset provides a controlled yet realistic level of imbalance suitable for evaluating model robustness to non-uniform class distributions and for exploring sampling-aware training approaches in intrusion detection research.

Cite

Panigrahi, R., & Borah, S. (2018). A detailed analysis of CICIDS2017 dataset for designing Intrusion Detection Systems. International Journal of Engineering & Technology, 7(3.24), 479-482.

Iman Sharafaldin, Arash Habibi Lashkari, and Ali A. Ghorbani, “Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization”, 4th International Conference on Information Systems Security and Privacy (ICISSP), Portugal, January 2018.