vyykaaa/dataset_all

---
pretty_name: Web Traffic Normal vs Anomalous
language:
- en
license: mit
task_categories:
- text-classification
tags:
- cybersecurity
- intrusion-detection
- web-security
- http
- anomaly-detection
size_categories:
- 10K<n<100K
---

# Web Traffic Normal vs Anomalous

A labeled HTTP request dataset for web traffic classification.

This dataset contains raw HTTP requests collected into two classes:

- `anomalous`: malicious or attack-like traffic
- `normal`: benign traffic

## Important note about data integrity

The request payloads are kept as raw text. No normalization, decoding, truncation, lowercasing, header removal, or field cleaning was applied when creating the labeled files. The only added field is `label`.

## Files

Recommended files for Hugging Face Datasets:

- `web_traffic_labeled_combined.jsonl`
- `filtered_anomalous_traffic_labeled.jsonl`
- `normalTrafficTest_clean_labeled.jsonl`

Also included:

- `web_traffic_labeled_combined.csv`
- `filtered_anomalous_traffic_labeled.csv`
- `normalTrafficTest_clean_labeled.csv`

## Dataset schema

Each example has the following fields:

- `text` (`string`): full raw HTTP request, including line breaks
- `label` (`string`): one of `anomalous` or `normal`

### Example

```json
{
"text": "GET http://localhost:8080/tienda1/index.jsp HTTP/1.1\nUser-Agent: Mozilla/5.0 ...",
"label": "normal"
}
```

## Class distribution

- `anomalous`: 2,014
- `normal`: 36,000
- total: 38,014

## Recommended usage

This dataset is suitable for:

- web attack detection
- anomaly detection
- HTTP request classification
- WAF / IDS experimentation
- baseline text classification benchmarks for cybersecurity

## Loading with `datasets`

### Load the combined JSONL file

```python
from datasets import load_dataset

dataset = load_dataset("json", data_files="web_traffic_labeled_combined.jsonl")
print(dataset["train"][0])
```

### Load train/test splits from local files

```python
from datasets import load_dataset

dataset = load_dataset(
"json",
data_files={
"train": "web_traffic_labeled_combined.jsonl",
},
)
```

## Repository layout suggestion

```text
.
├── README.md
├── web_traffic_labeled_combined.jsonl
├── filtered_anomalous_traffic_labeled.jsonl
├── normalTrafficTest_clean_labeled.jsonl
├── web_traffic_labeled_combined.csv
├── filtered_anomalous_traffic_labeled.csv
└── normalTrafficTest_clean_labeled.csv
```

## Limitations

- The labels are binary only: `normal` and `anomalous`
- The dataset may contain duplicated request patterns
- The traffic appears to come from a web application testing context and may not cover all modern attack families
- Credentials, hostnames, and request contents should be reviewed before production use

## Citation

If you publish work based on this dataset, please cite the dataset repository URL.