# HDLNIDS: Hybrid Deep-Learning-Based Network Intrusion Detection System
## 5 Dataset Detail  
Selecting appropriate ID data to analyze the ID system is crucial, so we chose the data preceding the simulation of the suggested methodology. Even though many ID databases are openly available, several of them contain outdated, inaccurate, and unreproducible intrusions. To address these shortcomings and generate current traffic patterns, the Amazon Web services (AWS) platform created the well-known CICDS-2018 [47] dataset. The CICIDS 2018 intrusion dataset depicts real-time network behavior and includes a variety of intrusion modes. Furthermore, it is spread as a full network that encompasses all of the internal networks traced to compute data packet payloads. These qualities of the CICIDS-2018 dataset compelled us to use it in our research for the proposed system.  
This dataset provides many intrusion patterns that may be applied to a variety of network protocols and topologies about safety and security. This dataset is an upgrade to the CICIDS-2017 dataset.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Features** & **Description** \\ \hline Fw-iat-min & The shortest delay between two packets supplied in an onward route. \\ Bw-iat-tot & The total lag time between two packets transmitted via a back channel. \\ Bw-iat-avg & The average time between two packets transmitted through a back channel. \\ Bw-iat-std & The average time between two packets transmitted in the reverse direction. \\ Bw-iat-max & The highest time between two packets transmitted in the reverse direction. \\ Bw-iat-min & The shortest time between two packets transmitted in a forward direction. \\ Bw-iat-min & The lowest time between two packets transmitted in a reverse direction. \\ Fw-pkt-l-avg & The average quantity of data in a packet in an upward direction \\ Fw-pkt-l-min & The lowest volume of the package \\ Tot-bv-pk & Overall data packets in a back channel \\ Tot-lf-fw-pkt & Overall size of the packet in an up channel \\ Tot-fw-pk & Forwardly aggregate data packets \\ Fl-iat-max & The highest-duration period between two flows \\ Fl-dur & Interval of flow \\ \hline \hline \end{tabular}
\end{table}
Table 1: An overview of the CICIDS-2018 ID dataset’s extracted characteristics.  
CICIDS-2018 is a publicly accessible dataset with two patterns and seven intrusion techniques at the moment. Multiple data states were gathered, and raw data were refreshed. CICIDS-2018 contains 80 statistical features measured in forward and reverse modes, such as volume, packet length, and the number of bytes. Finally, the dataset, which had around 5 million entries, was made available to all researchers over the internet. The CICIDS-2018 dataset is available in PCAP and CSV formats. In this research, we considered the use of CSV format, whereas the PCAP format is utilized to extract innovative features [48,49]. This CICIDS-2018 dataset includes various categories of attacks:  
* Brute-force DOS attacks;
* Botnet;
* Heartbleed;
* DDOS attacks;
* Brute-force SSH;
* Infiltration;
* Web attacks.  
The dataset framework comprises 50 systems, whereas the attacking firms comprise 31 servers and 421 endpoints. CICIDS-2018 data provide AWS-recorded network traffic and a system log containing 80 retrieved parameters using CICFlowMeter-V3. The CICIDS-2018 dataset is approximately 400 GB in size, which is greater than the CICIDS-2017 dataset. Table 1 shows a few retrieved characteristics from the CICIDS-2018 dataset. The sample size of the CICIDS-2018 dataset was compared to that of CICIDS-2017. Table 2 displays the outcomes of both datasets, notably in the Botnet and Infiltration assaults, where it increased by 143 and 4497, respectively. Moreover, the number of Internet Attacks provided in CICIDS-2018 is quite low (928). Table 2 presents the comparison between CICIDS-2018 and CICIDS-2017 datasets.