Errors in the CICIDS2017 dataset and the significant differences in detection performances it makes - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2023

Errors in the CICIDS2017 dataset and the significant differences in detection performances it makes

Résumé

Among the difficulties encountered in building datasets to evaluate intrusion detection tools, a tricky part is the process of labelling the events into malicious and benign classes. The labelling correctness is paramount for the quality of the evaluation of intrusion detection systems but is often considered as the ground truth by practitioners and is rarely verified. Another difficulty lies in the correct capture of the network packets. If it is not the case, the characteristics of the network flows generated from the capture could be modified and lead to false results. In this paper, we present several flaws we identified in the labelling of the CICIDS2017 dataset and in the traffic capture, such as packet misorder, packet duplication and attack that were performed but not correctly labelled. Finally, we assess the impact of these different corrections on the evaluation of supervised intrusion detection approaches.
Fichier principal
Vignette du fichier
CRiSIS_2022_Maxime_Lanvin.pdf (700.84 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03775466 , version 1 (12-09-2022)

Licence

Paternité

Identifiants

Citer

Maxime Lanvin, Pierre-François Gimenez, Yufei Han, Frédéric Majorczyk, Ludovic Mé, et al.. Errors in the CICIDS2017 dataset and the significant differences in detection performances it makes. 17th International Conference on Risks and Security of Internet and Systems (CRiSIS), Dec 2022, Sousse, Tunisia. pp.18-33, ⟨10.1007/978-3-031-31108-6_2⟩. ⟨hal-03775466⟩
716 Consultations
1179 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More