Table 1 Distribution of attack types in five datasets.
NF-CSE-CIC-IDS2018-v2 | NF-ToN-IoT-v2 | CIC-ToN-IoT | NF-UNSW-NB15-v2 | NF-BoT-IoT-v2 | |||||
---|---|---|---|---|---|---|---|---|---|
Class | Count | Class | Count | Class | Count | Class | Count | Class | Count |
DDOS attack-HOIC | 1,080,858 | Benign | 6,099,469 | Benign | 2,515,236 | Analysis | 2299 | Benign | 135,037 |
DoS attacks-Hulk | 432,648 | Scanning | 3,781,419 | Backdoor | 27,145 | Backdoor | 2169 | DDoS | 18,331,847 |
DDoS attacks-LOIC-HTTP | 307,300 | xss | 2,455,020 | dos | 145 | Benign | 2,295,222 | DoS | 16,673,183 |
Infilteration | 116,361 | ddos | 2,026,234 | ddos | 202 | DoS | 5,794 | Theft | 2,431 |
SSH-Bruteforce | 94,979 | Password | 1,153,323 | Injection | 277,696 | Exploits | 31,551 | Reconnaissance | 2,620,999 |
Bot | 143,097 | dos | 712,609 | mitm | 517 | Fuzzers | 22,310 | Â | Â |
DoS attacks-GoldenEye | 27,723 | Injection | 684,465 | Password | 340,208 | Generic | 16,560 | Â | Â |
FTP-BruteForce | 25,933 | Backdoor | 16,809 | Ransomware | 5098 | Reconnaissance | 12,779 | Â | Â |
DoS attacks-SlowHTTPTest | 14,116 | mitm | 7723 | Scanning | 36,205 | Worms | 164 | Â | Â |
DoS attacks-Slowloris | 9512 | Ransomware | 3425 | xss | 2,149,308 | Shellcode | 1427 | Â | Â |
Brute Force -Web | 2143 | Â | Â | Â | Â | Â | Â | Â | Â |
DDOS attack-LOIC-UDP | 2112 | Â | Â | Â | Â | Â | Â | Â | Â |
Brute Force -XSS | 927 | Â | Â | Â | Â | Â | Â | Â | Â |
SQL Injection | 432 | Â | Â | Â | Â | Â | Â | Â | Â |
Benign | 16,635,567 | Â | Â | Â | Â | Â | Â | Â | Â |
Total | 18,893,708 | Total | 16,940,496 | Total | 5,351,760 | Total | 2,390,275 | Total | 37,763,497 |