Network traffic and code for machine learning classification

The dataset is a set of network traffic traces in pcap/csv format captured from a single user. The traffic is classified in 5 different activities (Video, Bulk, Idle, Web, and Interactive) and the label is shown in the filename. There is also a file (mapping.csv) with the mapping of the host's IP address, the csv/pcap filename and the activity label. Activities: Interactive: applications that perform real-time interactions in order to provide a suitable user experience, such as editing a file in google docs and remote CLI's sessions by SSH. Bulk data transfer: applications that perform a transfer of large data volume files over the network. Some examples are SCP/FTP applications and direct downloads of large files from web servers like Mediafire, Dropbox or the university repository among others. Web browsing: contains all the generated traffic while searching and consuming different web pages. Examples of those pages are several blogs and new sites and the moodle of the university. Vídeo playback: contains traffic from applications that consume video in streaming or pseudo-streaming. The most known server used are Twitch and Youtube but the university online classroom has also been used. Idle behaviour: is composed by the background traffic generated by the user computer when the user is idle. This traffic has been captured with every application closed and with some opened pages like google docs, YouTube and several web pages, but always without user interaction. The capture is performed in a network probe, attached to the router that forwards the user network traffic, using a SPAN port. The traffic is stored in pcap format with all the packet payload. In the csv file, every non TCP/UDP packet is filtered out, as well as every packet with no payload. The fields in the csv files are the following (one line per packet): Timestamp, protocol, payload size, IP address source and destination, UDP/TCP port source and destination. The fields are also included as a header in every csv file. The amount of data is stated as follows: Bulk : 19 traces, 3599 s of total duration, 8704 MBytes of pcap files Video : 23 traces, 4496 s, 1405 MBytes Web : 23 traces, 4203 s, 148 MBytes Interactive : 42 traces, 8934 s, 30.5 MBytes Idle : 52 traces, 6341 s, 0.69 MBytes The code of our machine learning approach is also included. There is a README.txt file with the documentation of how to use the code.

本数据集为单用户环境下捕获的网络流量轨迹集合，格式包含pcap与csv两种。流量共分为5类活动：视频（Video）、批量传输（Bulk）、空闲（Idle）、网页浏览（Web）与交互式（Interactive），类别标签已内嵌于文件名中。另有mapping.csv文件，用于映射主机IP地址、csv/pcap文件名与活动标签。

各类活动说明如下：
交互式活动：指为提供优质用户体验而开展实时交互的应用，例如谷歌文档在线编辑、通过SSH实现的远程命令行界面会话。
批量数据传输：指在网络中传输大容量文件的应用，典型示例包括SCP/FTP类应用，以及从Mediafire、Dropbox或大学仓库等Web服务器直接下载大文件的操作。
网页浏览：涵盖用户搜索、浏览各类网页时产生的全部流量，示例包括各类博客、新闻站点以及大学的Moodle平台。
视频播放：涵盖流媒体或伪流媒体视频应用产生的流量，主流服务包括Twitch与YouTube，同时也包含大学在线课堂产生的流量。
空闲行为：指用户处于空闲状态时用户计算机产生的后台流量。本次捕获在所有应用程序关闭，或仅保留谷歌文档、YouTube及若干网页页面打开但无任何用户交互的场景下完成。

本次捕获通过连接转发用户网络流量的路由器的SPAN端口的网络探针完成。流量以pcap格式存储，包含所有数据包负载。在csv文件中，已过滤掉所有非TCP/UDP数据包以及无负载的数据包。csv文件的字段如下（每一行对应一个数据包）：时间戳、协议、负载大小、源与目的IP地址、UDP/TCP源端口与目的端口。每个csv文件的首行均包含上述字段作为表头。

各分类数据规模如下：
- 批量传输：19条轨迹，总时长3599秒，pcap文件总大小8704 MB
- 视频播放：23条轨迹，总时长4496秒，总大小1405 MB
- 网页浏览：23条轨迹，总时长4203秒，总大小148 MB
- 交互式活动：42条轨迹，总时长8934秒，总大小30.5 MB
- 空闲行为：52条轨迹，总时长6341秒，总大小0.69 MB

本数据集还附带了本次所用机器学习方法的代码，另有README.txt文件详细说明代码的使用方法。

搜集汇总

背景与挑战

背景概述

该数据集是一个用于机器学习分类的网络流量数据集，包含从单个用户捕获的pcap/csv格式流量痕迹，分类为视频、批量、空闲、网页和交互式五种活动，并附带活动标签和映射文件。数据集提供了详细的流量捕获信息（如协议、有效载荷大小和IP地址）以及每种活动的数据量统计，同时包含机器学习代码和文档，适用于网络流量分析和分类模型训练。