A Labeled Data Set for Flow-Based Intrusion Detection

Abstract. Flow-based intrusion detection has recently become a promising security mechanism in high speed networks (1-10 Gbps). Despite the richness in contributions in this field, benchmarking of flow-based IDS is still an open issue. In this paper, we propose the first publicly available, labeled data set for flowbased intrusion detection. The data set aims to be realistic, i.e., representative of real traffic and complete from a labeling perspective. Our goal is to provide such enriched data set for tuning, training and evaluating ID systems. Our setup is based on a honeypot running widely deployed services and directly connected to the Internet, ensuring attack-exposure. The final data set consists of 14.2M flows and more than 98% of them has been labeled.

• Type: Conference
• Year: 2009
• Where: IPOM
• Authors: Anna Sperotto, Ramin Sadre, Frank van Vliet, Aiko Pras
• Keywords: Computer Networks, Data Set, Flow-based Intrusion Detection, Intrusion Detection, IPOM 2009