DDOS attack SDN Dataset

This is a SDN specific data set generated by using mininet emulator and used for traffic classification by machine learning and deep learning algorithms. The project start by creating ten topologies in mininet in which switches are connected to single Ryu controller. Network simulation runs for benign TCP, UDP and ICMP traffic and malicious traffic which is the collection of TCP Syn attack, UDP Flood attack, ICMP attack. Total 23 features are available in the data set in which some are extracted from the switches and others are calculated. Extracted features include Switch-id, Packet_count, byte_count, duration_sec, duration_nsec which is duration in nano-seconds, total duration is sum of duration_sec and durstaion_nsec, Source IP, Destination IP, Port number, tx_bytes is the number of bytes transferred from the switch port, rx_bytes is the number of bytes received on the switch port. dt field show the date and time which has been converted into number and a flow is monitored at a monitoring interval of 30 second. Calculated features include Packet per flow which is packet count during a single flow, Byte per flow is byte count during a single flow, Packet Rate is number of packets send per second and calculated by dividing the packet per flow by monitoring interval, number of Packet_ins messages, total flow entries in the switch, tx_kbps, rx_kbps are data transfer and receiving rate and Port Bandwidth is the sum of tx_kbps and rx_kbps. Last column indicates the class label which indicates whether the traffic type is benign or malicious. Benign traffic has label 0 and malicious traffic has label 1. Network simulation is run for 250 minutes and 1,04,345 rows of data is collected. The simulation is run for defined interval again and more data can be collected.

本数据集为软件定义网络（Software Defined Network, SDN）专用数据集，依托Mininet仿真器生成，可用于机器学习与深度学习算法开展流量分类任务。本项目首先在Mininet中创建10种拓扑结构，所有交换机均连接至单个Ryu控制器。网络仿真覆盖良性TCP、UDP、ICMP流量，以及由TCP SYN攻击、UDP Flood攻击、ICMP攻击组成的恶意流量。数据集共包含23项特征，其中部分特征直接从交换机提取，其余特征为计算衍生特征。提取得到的特征包括：交换机ID（Switch-id）、数据包计数（Packet_count）、字节计数（byte_count）、持续秒数（duration_sec）、持续纳秒数（duration_nsec，总持续时长为duration_sec与duration_nsec之和）、源IP地址（Source IP）、目的IP地址（Destination IP）、端口号（Port number）、发送字节数（tx_bytes，即交换机端口向外传输的字节总量）、接收字节数（rx_bytes，即交换机端口接收的字节总量）。dt字段用于记录日期与时间，已被转换为数值格式；流量监测间隔为30秒，在此间隔内完成单条数据流的监测。计算衍生特征包括：单流数据包数（Packet per flow，即单条流内的数据包总量）、单流字节数（Byte per flow，即单条流内的字节总量）、数据包速率（Packet Rate，通过单流数据包数除以监测间隔计算得到，即每秒发送的数据包数量）、Packet_ins消息总数、交换机总流表项数、tx_kbps（端口向外传输的数据速率，单位为千比特每秒）、rx_kbps（端口向内接收的数据速率，单位为千比特每秒），以及端口总带宽（Port Bandwidth，为tx_kbps与rx_kbps之和）。数据集最后一列为类别标签，用于标识流量类型为良性或恶意：良性流量标注为0，恶意流量标注为1。本次仿真运行时长为250分钟，共采集得到104345条数据记录。用户可按照预设监测间隔重复运行仿真，以采集更多数据集样本。

搜集汇总

背景与挑战

背景概述

该数据集是一个专门用于SDN的DDoS攻击数据集，包含良性流量和多种恶意攻击流量，具有23个特征，用于机器学习和深度学习算法的流量分类。数据集规模为104,345行，模拟运行时间为250分钟，并且可以进一步扩展。