DAST scanning sessions dataset

This dataset consists of network flow features generated by the tool CICFlowMeter on network captures collected at the University of Belgrade, School of Electrical Engineering. The samples include scanning sessions of 4 DAST tools - Nikto, Vega, OWASP ZAP and Arachni targeted at the OWASP WebGoat application. DAST tools were installed on one virtual machine, while the target was placed on another, with all traffic being routed through a third machine which captured it using the tcpdump utility. For each of the scanners one session was captured, except Arachni, whose scanning phase was divided into 3 sessions. After processing the .pcap files with CICFlowMeter, the output for each of the sessions was split randomly into training, validation and test sets in 60:20:20 ratio, respectively. In addition to the scanning, OWASP ZAP and Vega offer built-in proxy servers for HTTP traffic examination. Interactions of these utilities and Webgoat application were also captured and are present in the dast proxies folder. Finally, in shortened flows, for each of the the scanning sessions, a subset of flows was pruned to 10, 15, 20, 25 and 50 packets. Features were extracted using CICFlowMeter once again, to allow for analysis of flow statistics at different points in time本数据集由贝尔格莱德大学电气工程学院采集的网络流量捕获文件，经CICFlowMeter工具提取得到的网络流特征组成。样本涵盖针对OWASP WebGoat应用的4款动态应用安全测试（Dynamic Application Security Testing, DAST）工具扫描会话，涉及Nikto、Vega、OWASP ZAP及Arachni四款工具。测试环境部署如下：DAST工具安装于一台虚拟机，目标应用部署于另一台虚拟机，所有流量经第三台机器路由转发，并通过tcpdump工具完成捕获。除Arachni将扫描阶段拆分为3个会话外，其余扫描器各对应1个捕获会话。使用CICFlowMeter处理所有.pcap格式的流量捕获文件后，将每个会话的输出结果按60:20:20的比例随机划分为训练集、验证集与测试集。此外，OWASP ZAP与Vega均内置用于HTTP流量检测的代理服务器，两款工具与WebGoat应用的交互流量同样被捕获，并存储于dast proxies文件夹中。最后，针对每个扫描会话，将其流量子集分别修剪至10、15、20、25及50个数据包，并再次使用CICFlowMeter提取特征，以支持不同时间节点下流统计特征的分析。