DDOS attack SDN Dataset

This is a SDN specific data set generated by using mininet emulator and used for traffic classification by machine learning and deep learning algorithms. The project start by creating ten topologies in mininet in which switches are connected to single Ryu controller. Network simulation runs for benign TCP, UDP and ICMP traffic and malicious traffic which is the collection of TCP Syn attack, UDP Flood attack, ICMP attack. Total 23 features are available in the data set in which some are extracted from the switches and others are calculated. Extracted features include Switch-id, Packet_count, byte_count, duration_sec, duration_nsec which is duration in nano-seconds, total duration is sum of duration_sec and durstaion_nsec, Source IP, Destination IP, Port number, tx_bytes is the number of bytes transferred from the switch port, rx_bytes is the number of bytes received on the switch port. dt field show the date and time which has been converted into number and a flow is monitored at a monitoring interval of 30 second. Calculated features include Packet per flow which is packet count during a single flow, Byte per flow is byte count during a single flow, Packet Rate is number of packets send per second and calculated by dividing the packet per flow by monitoring interval, number of Packet_ins messages, total flow entries in the switch, tx_kbps, rx_kbps are data transfer and receiving rate and Port Bandwidth is the sum of tx_kbps and rx_kbps. Last column indicates the class label which indicates whether the traffic type is benign or malicious. Benign traffic has label 0 and malicious traffic has label 1. Network simulation is run for 250 minutes and 1,04,345 rows of data is collected. The simulation is run for defined interval again and more data can be collected.

本数据集为专用软件定义网络（Software Defined Network, SDN）数据集，基于Mininet仿真器生成，用于机器学习与深度学习算法开展流量分类任务。
本数据集的构建流程为先在Mininet中创建10种拓扑结构，拓扑内交换机均连接至单一Ryu控制器。
网络仿真阶段将生成正常TCP、UDP与ICMP流量，以及由TCP SYN攻击、UDP泛洪攻击、ICMP攻击构成的恶意流量。
本数据集共包含23项特征，其中部分特征从交换机中直接提取，其余特征则通过计算得到。
直接提取的特征包括：交换机ID（Switch-id）、数据包计数（Packet_count）、字节计数（byte_count）、秒级时长（duration_sec）、纳秒级时长（duration_nsec，总时长为秒级时长与纳秒级时长之和）、源IP地址（Source IP）、目的IP地址（Destination IP）、端口号（Port number）、交换机端口发送字节数（tx_bytes）、交换机端口接收字节数（rx_bytes）。dt字段为日期时间信息，已转换为数值格式，流量监测间隔为30秒。
计算得到的特征包括：每流数据包数（Packet per flow，即单条流内的数据包总数）、每流字节数（Byte per flow，即单条流内的总字节数）、数据包速率（Packet Rate，单位时间内发送的数据包数量，通过每流数据包数除以监测间隔计算得到）、数据包入（Packet_in）消息总数、交换机总流表项数、数据发送速率（tx_kbps）、数据接收速率（rx_kbps），以及端口带宽（Port Bandwidth，为tx_kbps与rx_kbps之和）。
数据集最后一列为类别标签，用于标识流量类型为正常或恶意：正常流量标签为0，恶意流量标签为1。
本次网络仿真总时长为250分钟，共采集到104345条数据样本。可通过重复指定间隔的仿真流程获取更多数据集。

搜集汇总

背景与挑战

背景概述

该数据集是一个专门针对软件定义网络（SDN）的DDoS攻击数据集，通过Mininet模拟器生成，包含良性流量和三种恶意攻击流量（TCP Syn、UDP Flood、ICMP），共104,345行数据、23个网络流量特征，并标注二元分类标签，适用于机器学习与深度学习的流量分类研究。