# Machine Learning for Network Intrusion Detection--A Comparative Study
## 2 The CICIDS-2017 Dataset  
The Canadian Institute of Cybersecurity's data are used in this research to train ML models to detect different attacks, specifically the CICIDS-2017 dataset [15]. The dataset consists of eight files that contain simulated network traffic captured over five days. Table 1 shows the different files and the types of traffic (benign or security attacks) captured during this period. The dataset contains 3,119,345 samples with 78 features that belong to 15 classes. \begin{table}
\begin{tabular}{l l l} \hline \hline
**No.** & **File Name** & **Traffic Types** \\ \hline
1 & Monday-WorkingHours.pcap\_ISCX.csv & Benign \\ \hline
2 & Tuesday-WorkingHours.pcap\_ISCX.csv & Benign, FIT-Patator, SSH-Patator \\ \hline
3 & Wednesday-WorkingHours.pcap\_ISCX.csv & Benign, DoG GoldenEye, DoS Hulk, DoS Slowhttptest, DoS slowloris, Heartbleed \\ \hline
4 & Thursday-WorkingHours-Morning-WebAttacks.pcap\_ISCX.csv & Benign, Web Attack—Brute Force, Web Attack–Sql Injection, Web Attack–XS \\ \hline
5 & Thursday-WorkingHours-Afternoon-Infiltration.pcap\_ISCX.csv & Benign, Infiltration \\ \hline
6 & Friday-WorkingHours-Morning.pcap\_ISCX.csv & Benign, Bot \\ \hline
7 & Friday-WorkingHours-Afternoon-PortScan.pcap\_ISCX.csv & Benign, PortScan \\ \hline
8 & Friday-WorkingHours-Afternoon-DDoS.pcap\_ISCX.csv & Benign, DDoS \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The CICIDS-2017 dataset files and their traffic content. The 15 different classes and the number of samples belonging to each are listed in Table 2. This dataset was chosen because it contains information on up-to-date attacks that are common in modern networks, unlike the outdated datasets used in other studies. The attacks in this dataset are classified into brute force FTP, brute force SSH, DoS, heartbleed, web, infiltration, botnet, and DDoS attacks based on the 2016 McAfee Report. These attacks are not found in any of the previously published datasets [16]. Furthermore, the dataset fulfills all the criteria of a true intrusion detection dataset [15; 17], including a complete network configuration, complete traffic, a labeled dataset, complete interaction, complete capture, available protocols, attack diversity, heterogeneity, a feature set, and metadata. Table 3 provides a complete list of features that meet these criteria. The uneven distribution of classes in the CICIDS-2017 dataset shows the class imbalance problem [13], which is common in many machine learning problems, such as network intrusion detection, medical diagnosis, and fraud detection. In datasets with class imbalance, most samples are classified as one class, while fewer samples are classified as other classes whose accurate detection by machine learning is more significant. The training of machine learning algorithms using datasets suffering from the class imbalance problem creates models that are biased towards majority classes. This is because the classifiers tend to place less emphasis on learning minority classes and become overwhelmed by majority classes. The class imbalance problem in the CICIDS-2017 dataset is one of the main problems when using this dataset. There is a tendency for models to become biased towards benign traffic, since there are significantly more benign traffic samples (over 2 million) compared to attacks (e.g., Bot and Heartbleed attacks are only seen in 36 and 11 samples, respectively). However, an IDS requires attack detection not to be biased towards detecting benign traffic. Consequently, any machine learning approach using the CICIDS-2017 dataset should address the class imbalance problem to detect attacks precisely.