Zeek flows extracted from ISCX IDS 2017 Dataset

Zeek is used to extract structured network metadata from the raw packet captures. Each PCAP file is processed sequentially, disabling checksum validation to maximize packet ingestion and avoid discarding packets due to checksum inconsistencies commonly found in offline captures. During this process, Zeek aggregates individual packets into bidirectional network connections. Each connection represents a distinct network flow and is identified by the origin and responder IP addresses, their corresponding ports, the transport protocol, and a unique Zeek identifier. In addition to the standard connection-level attributes, such as duration, connection state, byte counts, and packet counts, the flow records are enriched with application-layer information. As a result, the generated flows incorporate additional contextual attributes such as HTTP URIs, TLS/SSL metadata, and DNS queries, which are particularly relevant for characterizing application-layer attacks.