Errors in the CICIDS2017 dataset and the significant differences in detection performances it makes - Archive ouverte HAL Access content directly
Conference Papers Year : 2023

Errors in the CICIDS2017 dataset and the significant differences in detection performances it makes

Abstract

Among the difficulties encountered in building datasets to evaluate intrusion detection tools, a tricky part is the process of labelling the events into malicious and benign classes. The labelling correctness is paramount for the quality of the evaluation of intrusion detection systems but is often considered as the ground truth by practitioners and is rarely verified. Another difficulty lies in the correct capture of the network packets. If it is not the case, the characteristics of the network flows generated from the capture could be modified and lead to false results. In this paper, we present several flaws we identified in the labelling of the CICIDS2017 dataset and in the traffic capture, such as packet misorder, packet duplication and attack that were performed but not correctly labelled. Finally, we assess the impact of these different corrections on the evaluation of supervised intrusion detection approaches.
Fichier principal
Vignette du fichier
CRiSIS_2022_Maxime_Lanvin.pdf (700.84 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03775466 , version 1 (12-09-2022)

Licence

Attribution

Identifiers

Cite

Maxime Lanvin, Pierre-François Gimenez, Yufei Han, Frédéric Majorczyk, Ludovic Mé, et al.. Errors in the CICIDS2017 dataset and the significant differences in detection performances it makes. CRiSIS 2022 - 17th International Conference on Risks and Security of Internet and Systems, Dec 2022, Sousse, Tunisia. pp.18-33, ⟨10.1007/978-3-031-31108-6_2⟩. ⟨hal-03775466⟩
665 View
1071 Download

Altmetric

Share

Gmail Facebook X LinkedIn More