A Labeled Data Set For Flow-based Intrusion Detection

Anna Sperotto; Ramin Sadre; Frank van Vliet; Aiko Pras

doi:10.1007/978-3-642-04968-2_4

A Labeled Data Set For Flow-based Intrusion Detection

Anna Sperotto
, Ramin Sadre
, Frank van Vliet
, Aiko Pras

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

133 Citations (Scopus)

852 Downloads (Pure)

Abstract

Flow-based intrusion detection has recently become a promising security mechanism in high speed networks (1-10 Gbps). Despite the richness in contributions in this field, benchmarking of flow-based IDS is still an open issue. In this paper, we propose the first publicly available, labeled data set for flow-based intrusion detection. The data set aims to be realistic, i.e., representative of real traffic and complete from a labeling perspective. Our goal is to provide such enriched data set for tuning, training and evaluating ID systems. Our setup is based on a honeypot running widely deployed services and directly connected to the Internet, ensuring attack-exposure. The final data set consists of 14.2M flows and more than 98% of them has been labeled.

Original language	English
Title of host publication	IP Operations and Management
Subtitle of host publication	9th IEEE International Workshop, IPOM 2009, Venice, Italy, October 29-30, 2009. Proceedings
Editors	Giorgio Nunzi, Caterina Scoglio, Xing Li
Place of Publication	Berlin
Publisher	Springer
Pages	39-50
Number of pages	12
ISBN (Electronic)	978-3-642-04968-2
ISBN (Print)	978-3-642-04967-5
DOIs	https://doi.org/10.1007/978-3-642-04968-2_4
Publication status	Published - 21 Oct 2009
Event	9th IEEE International Workshop on IP Operations and Management, IPOM 2009 - Venice, Italy Duration: 29 Oct 2009 → 30 Oct 2009 Conference number: 9

Publication series

Name	Lecture Notes in Computer Science
Publisher	Springer
Volume	5843
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Workshop

Workshop	9th IEEE International Workshop on IP Operations and Management, IPOM 2009
Abbreviated title	IPOM
Country/Territory	Italy
City	Venice
Period	29/10/09 → 30/10/09

Access to Document

10.1007/978-3-642-04968-2_4

Sperotto2009labeledProof, 228 KB

Cite this

Sperotto, A., Sadre, R., van Vliet, F., & Pras, A. (2009). A Labeled Data Set For Flow-based Intrusion Detection. In G. Nunzi, C. Scoglio, & X. Li (Eds.), IP Operations and Management: 9th IEEE International Workshop, IPOM 2009, Venice, Italy, October 29-30, 2009. Proceedings (pp. 39-50). (Lecture Notes in Computer Science; Vol. 5843). Springer. https://doi.org/10.1007/978-3-642-04968-2_4

@inproceedings{64dea61d507b46fea08044c71f52b5a3,

title = "A Labeled Data Set For Flow-based Intrusion Detection",

abstract = "Flow-based intrusion detection has recently become a promising security mechanism in high speed networks (1-10 Gbps). Despite the richness in contributions in this field, benchmarking of flow-based IDS is still an open issue. In this paper, we propose the first publicly available, labeled data set for flow-based intrusion detection. The data set aims to be realistic, i.e., representative of real traffic and complete from a labeling perspective. Our goal is to provide such enriched data set for tuning, training and evaluating ID systems. Our setup is based on a honeypot running widely deployed services and directly connected to the Internet, ensuring attack-exposure. The final data set consists of 14.2M flows and more than 98\% of them has been labeled.",

author = "Anna Sperotto and Ramin Sadre and \{van Vliet\}, Frank and Aiko Pras",

year = "2009",

month = oct,

day = "21",

doi = "10.1007/978-3-642-04968-2\_4",

language = "English",

isbn = "978-3-642-04967-5",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "39--50",

editor = "Giorgio Nunzi and Caterina Scoglio and Xing Li",

booktitle = "IP Operations and Management",

address = "Germany",

note = "9th IEEE International Workshop on IP Operations and Management, IPOM 2009, IPOM ; Conference date: 29-10-2009 Through 30-10-2009",

}

Sperotto, A, Sadre, R, van Vliet, F & Pras, A 2009, A Labeled Data Set For Flow-based Intrusion Detection. in G Nunzi, C Scoglio & X Li (eds), IP Operations and Management: 9th IEEE International Workshop, IPOM 2009, Venice, Italy, October 29-30, 2009. Proceedings. Lecture Notes in Computer Science, vol. 5843, Springer, Berlin, pp. 39-50, 9th IEEE International Workshop on IP Operations and Management, IPOM 2009, Venice, Italy, 29/10/09. https://doi.org/10.1007/978-3-642-04968-2_4

A Labeled Data Set For Flow-based Intrusion Detection. / Sperotto, Anna; Sadre, Ramin; van Vliet, Frank et al.
IP Operations and Management: 9th IEEE International Workshop, IPOM 2009, Venice, Italy, October 29-30, 2009. Proceedings. ed. / Giorgio Nunzi; Caterina Scoglio; Xing Li. Berlin: Springer, 2009. p. 39-50 (Lecture Notes in Computer Science; Vol. 5843).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - A Labeled Data Set For Flow-based Intrusion Detection

AU - Sperotto, Anna

AU - Sadre, Ramin

AU - van Vliet, Frank

AU - Pras, Aiko

N1 - Conference code: 9

PY - 2009/10/21

Y1 - 2009/10/21

N2 - Flow-based intrusion detection has recently become a promising security mechanism in high speed networks (1-10 Gbps). Despite the richness in contributions in this field, benchmarking of flow-based IDS is still an open issue. In this paper, we propose the first publicly available, labeled data set for flow-based intrusion detection. The data set aims to be realistic, i.e., representative of real traffic and complete from a labeling perspective. Our goal is to provide such enriched data set for tuning, training and evaluating ID systems. Our setup is based on a honeypot running widely deployed services and directly connected to the Internet, ensuring attack-exposure. The final data set consists of 14.2M flows and more than 98% of them has been labeled.

AB - Flow-based intrusion detection has recently become a promising security mechanism in high speed networks (1-10 Gbps). Despite the richness in contributions in this field, benchmarking of flow-based IDS is still an open issue. In this paper, we propose the first publicly available, labeled data set for flow-based intrusion detection. The data set aims to be realistic, i.e., representative of real traffic and complete from a labeling perspective. Our goal is to provide such enriched data set for tuning, training and evaluating ID systems. Our setup is based on a honeypot running widely deployed services and directly connected to the Internet, ensuring attack-exposure. The final data set consists of 14.2M flows and more than 98% of them has been labeled.

U2 - 10.1007/978-3-642-04968-2_4

DO - 10.1007/978-3-642-04968-2_4

M3 - Conference contribution

SN - 978-3-642-04967-5

T3 - Lecture Notes in Computer Science

SP - 39

EP - 50

BT - IP Operations and Management

A2 - Nunzi, Giorgio

A2 - Scoglio, Caterina

A2 - Li, Xing

PB - Springer

CY - Berlin

T2 - 9th IEEE International Workshop on IP Operations and Management, IPOM 2009

Y2 - 29 October 2009 through 30 October 2009

ER -

A Labeled Data Set For Flow-based Intrusion Detection

Abstract

Publication series

Workshop

Access to Document

Fingerprint

Cite this