DOI: 10.5281/zenodo.3799932
title: Host Network Traffic 2019

description: <strong><em>Dataset Summary</em></strong> <strong>Timespan</strong>: 2019-01-01 : 2019-12-31 <strong>Granularity: </strong>1-hour disjoint time windows <strong># of characteristics observed: </strong>9 <strong>Hosts observed: </strong>65536 <strong>Labels: </strong>included <strong>Unzipped volume: </strong>approx. 10 GB <strong><em>Dataset Origins</em></strong> Dataset was collected over the <strong>whole year</strong> <strong> 2019</strong>. The observation points for the collection of IP flows were located at the borders of the university campus network. The campus university network has /16 CIDR IPv4 network range at disposal and contains various network segments from segments connecting dormitories, over server segments, to a segment containing working stations of university administrative workers. <strong>A host in our dataset is identified by its source IPv4 address. </strong> <em><strong>Variables</strong></em> The dataset contains the following variables: <strong>Aggregations</strong> - created sums of the individual variables over a one-hour interval: <strong># of flows </strong>- number of flows for a given source IP <strong># of packets </strong> - number of packets for a given source IP <strong># of bytes </strong> - number of packets for a given source IP <strong>flow duration </strong> - average flow duration in seconds <strong>Distinct Counts </strong>- count of distinct values for each variable over a one-hour window <strong># of peers </strong> - number of distinct communication peers for a given source IP <strong># of ports </strong> - number of distinct destination ports for a given source IP <strong># of protocols</strong> - number of distinct communication protocols for a given source IP <strong># of AS numbers</strong> - number of distinct destination AS numbers for a given source IP <strong># of countries </strong> - number of distinct destination countries for a given source <em><strong>Dataset Structure</strong></em> <strong>Dataset Files</strong> - each variable is contained in one <strong>Comma-Separated File (.csv) </strong>file <strong>Row index - </strong> timestamp of the observation window (8760 rows) <strong>Columns index - </strong> anonymized IP addresses (65536 columns) <strong>Label File - </strong>contains labels of the individual IP addresses from the Dataset Files <strong>Row index </strong>- anonymized IP addresses (65536 rows) <strong>Columns index </strong>- labels for the IP addresses <strong>Subnet </strong>- ID of a subnet - hosts belonging to the same subnet have the same Id. <strong>Subnet_range </strong>- CIDR range of a subnet <strong>Unit - </strong>an ID of administrative unit owning the network range <strong>Sub-unit </strong> - an ID of administrative sub-unit owning the network range <strong>Subnet_label - </strong>subnet label <strong>Servers - </strong>selected subnets containing mostly servers (133.250.178.0/24, 133.250.163.0/24) <strong>Workstations - </strong>selected subnets containing mostly workstations (133.250.146.0/24, 133.250.157.128/25) <strong><em>Further notes</em></strong> <strong>N/A values </strong> <strong>Variables </strong>- means that in a given observation window, the host did not communicate <strong>Labels - </strong>no additional information on this IP is available <strong>Dataset load </strong> <pre><code class="language-python">df = pd.read_csv(&lt;filename&gt;,header=[0], index_col=[0])</code></pre>