# A Complete EDA and DL Pipeline for Softwarized 5G Network Intrusion Detection
## 4 Dataset Description, Exploration, and Discussion
### General Description  
For the purpose of this research, the 5G Network Intrusion Detection Dataset (5G-NIDD), which contains concatenated data encompassing different attack scenarios, is utilized [65]. This dataset provides a comprehensive representation of network traffic data, including both malicious and benign activities. This dataset was collected from a 5G wireless network in Oulu, Finland, using the 5G Test Network (5 GTN) Finland, an open-source ecosystem dedicated to 5G and beyond research [65; 66]. Additional equipment used to facilitate data collection included Nokia Flexi Zone Indoor Pico Base Stations, Huawei modems, Raspberry Pi 4 Model B (as the attacker node), an HP laptop running Ubuntu (as the victim server), and a Dell switch [65]. This setup created realistic benign and malicious data flows.  
The dataset comprises 1,215,890 data points, with 477,737 representing benign activities and 738,153 representing various malicious activities, as shown in Figure 2. This indicates that the dataset is fairly balanced. This is in contrast to typical intrusion detection datasets, which are often imbalanced, as they have many more normal/benign data points compared to malicious/attack data points [67; 68]. Each data point includes 112 collected and encoded features. The malicious activities encompass various attack types, including denial-of-service (DoS) attacks (e.g., ICMP flood, SYN flood, HTTP flood) and port scan attacks (TCP scan and UDP scan).  
Each data point represents a data flow rather than a single packet. A flow is a collection of packets that are transmitted from one source (i.e., one source IP address and one source port) to one destination (one destination IP address and one destination port) using the same protocol [65]. This format provides a high-level description of the common features between transmissions. More specifically, using this format, packet-level features (such as the source IP, source port number, destination IP, destination port number, protocol, etc.) and flow-level features (such as the duration, runtime, total number of bytes, total number of packets, etc.) are collected. As a result, both port scanning attacks (such as UDP scan, SYN scan, etc.) and denial of service attacks (such as UDP flood, SYN flood, TCP flood, etc.) can be easily depicted. Thus, the dataset can describe what happens to the network over time, without explicitly being a time-series dataset. For more details on the dataset, its generation process, and the collected features, refer to the original source [65].  
As mentioned earlier, it is worth noting that, although having the number of attack instances is not typical in such an environment, the goal of having such a number of malicious attack instances is twofold. The first is to have fairly balanced data, so that any ML or DL intrusion detection framework is not biased, and hence there is no need for any oversampling to be conducted. The second reason is to have an ample number and variety of attack instances for the DL models to learn from. As a result, multiple performance evaluation metrics can be used, including accuracy, since its value would not be biased by a reduced number of attack data points or samples.