CICIDS2017-DOS (IB)

CICIDS2017-DOS (IB) is an imbalanced intrusion detection dataset derived from the CICIDS2017 collection and limited to benign traffic and five Denial-of-Service attack categories: DDoS, DoS GoldenEye, DoS Hulk, DoS Slowloris, and DoS SlowHTTPTest. The distribution remains intentionally skewed, with benign instances representing approximately 80% of the total samples, while each attack class contributes a smaller proportion of the dataset. This imbalance reflects real-world network traffic patterns, where malicious activity occurs sporadically compared to normal traffic.

The dataset was generated after consolidating raw files, removing incomplete or invalid entries, eliminating non-informative attributes, and converting textual fields such as IP addresses and timestamps into numeric form. The TUNE sampling process was applied with preserved skew conditions, allowing majority traffic to remain dominant while minority attack classes were retained in limited yet meaningful frequency. The resulting dataset includes 72 processed numerical features and is suitable for evaluating intrusion detection algorithms under realistic imbalance conditions, particularly in studies involving anomaly detection, rare event learning, and imbalanced classification strategies.

Cite

Panigrahi, R., & Borah, S. (2018). A detailed analysis of CICIDS2017 dataset for designing Intrusion Detection Systems. International Journal of Engineering & Technology, 7(3.24), 479-482.

Iman Sharafaldin, Arash Habibi Lashkari, and Ali A. Ghorbani, “Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization”, 4th International Conference on Information Systems Security and Privacy (ICISSP), Portugal, January 2018.