Errors in the CICIDS2017 dataset and the significant differences in detection performances it makes - Archive ouverte HAL Access content directly
Proceedings Year : 2023

Errors in the CICIDS2017 dataset and the significant differences in detection performances it makes

(1) , (1) , (2) , (3) , (2) , (4, 5, 6)
1
2
3
4
5
6

Abstract

Among the difficulties encountered in building datasets to evaluate intrusion detection tools, a tricky part is the process of labelling the events into malicious and benign classes. The labelling correctness is paramount for the quality of the evaluation of intrusion detection systems but is often considered as the ground truth by practitioners and is rarely verified. Another difficulty lies in the correct capture of the network packets. If it is not the case, the characteristics of the network flows generated from the capture could be modified and lead to false results. In this paper, we present several flaws we identified in the labelling of the CICIDS2017 dataset and in the traffic capture, such as packet misorder, packet duplication and attack that were performed but not correctly labelled. Finally, we assess the impact of these different corrections on the evaluation of supervised intrusion detection approaches.
Fichier principal
Vignette du fichier
CRiSIS_2022_Maxime_Lanvin.pdf (700.84 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03775466 , version 1 (12-09-2022)

Identifiers

  • HAL Id : hal-03775466 , version 1

Cite

Maxime Lanvin, Pierre-François Gimenez, Yufei Han, Frédéric Majorczyk, Ludovic Mé, et al.. Errors in the CICIDS2017 dataset and the significant differences in detection performances it makes. pp.1-16, 2023. ⟨hal-03775466⟩
71 View
57 Download

Share

Gmail Facebook Twitter LinkedIn More