anonymizeddb/CAD-CICIDS2017

CAD-CICIDS2017是一个用于网络入侵检测的单源持续异常检测基准场景，源自CIC-IDS2017数据集，将原始的表格网络入侵数据转换为按概念分组的任务序列。该数据集包含2,076,848个样本和6个任务，测试集中报告的异常比例为18.77%。数据集已进行匿名化处理，以支持双盲NeurIPS评审。它旨在用于研究持续异常检测、表格数据的持续学习、网络入侵检测、分布偏移下的鲁棒性、持续学习基准中的任务排序、相关网络流量概念间的遗忘和知识迁移，以及在顺序任务暴露下对异常检测器进行基准测试。数据集包含核心列（如任务ID、任务名称、任务拆分和标签）以及数值网络流特征（如目标端口、流持续时间、流字节/秒等）。此外，还提供了六个预定义的任务顺序，用于评估不同的持续学习动态，包括课程式适应、泛化导向顺序、平滑漂移和突然漂移。CAD-CICIDS2017 is a single-source continual anomaly detection benchmark scenario for network intrusion detection. It is derived from CIC-IDS2017 and converts the original tabular network-intrusion data into a sequence of concept-grouped tasks. The dataset contains 2,076,848 samples, 6 tasks, and has a reported 18.77% anomaly ratio in the test set. The dataset is anonymized for double-blind NeurIPS review. It is intended for research on continual anomaly detection, continual learning for tabular data, network intrusion detection, robustness under distribution shift, task ordering in continual-learning benchmarks, forgetting and knowledge transfer across related network-traffic concepts, and benchmarking anomaly detectors under sequential task exposure. The dataset includes core columns (e.g., task_id, task_name, task_split, label) and numerical network-flow features (e.g., Destination Port, Flow Duration, Flow Bytes/s). Additionally, it provides six predefined task orderings for evaluating different continual-learning dynamics, such as curriculum-like adaptation, generalization-oriented ordering, smooth drift, and abrupt drift.