# Generating Network Intrusion Detection Dataset Based on Real and Encrypted Synthetic Attack Traffic
## 6 Conclusions and Future Work  
Publicly available up-to-date datasets to benchmark and compare among IDS are important, especially as the network traffic is changing over time. There are two main contributions of this paper. First, we made a new requirement for building new datasets which are lacking in the existing datasets, such as anonymization, payload, ground-truth, encryption, and a practical method to implement it. Anonymizing certain data will prevent privacy issues, while capturing with the payload will enrich the information that we can collect for detecting malicious traffic within encrypted traffic. Providing the ground-truth data is crucial, so no unlabeled attack is recorded in the dataset. The lack of existing datasets with encrypted traffic, even though most present-day traffic use it for delivering attacks, has become our concern. Second, we generated a new IDS dataset called HIKARI-2021, which covers the network traffic with encrypted traces. The datasets were produced with a mix of ground-truth data, which are missing in the existing IDS datasets. The datasets are available publicly [68]. We adopted more than 80 features from CICIDS-2017 and added more features as a reference, such as a source IP address (originh), source port (originp), destination IP address, and destination port. We labeled each flow as benign or attack, where benign has two categories (Benign or Background), while attack has four (Bruteforce, Bruteforce-XML, Probing, and XMRIGCC CryptoMiner). We want to highlight what makes our dataset different from the existing IDS datasets. This is based on our proposed ideal requirements. The first is from the content requirements, \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Algorithm** & **Accuracy** & **Balanced Accuracy** & **Precision** & **Recall** & **F1** \\ \hline KNN & 0.98 & 0.94 & 0.86 & 0.90 & 0.88 \\ MLP & 0.99 & 0.99 & 0.99 & 0.99 & 0.99 \\ SVM & 0.99 & 0.99 & 0.99 & 0.98 & 0.99 \\ RF & 0.99 & 0.99 & 0.99 & 0.99 & 0.99 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Basic Performance Analysis. \begin{table}
\begin{tabular}{l l c c c c} \hline \hline
**Parameters** & **KDD99** & **UNSW-NB15** & **CICIDS-2017** & **HIKARI-2021** \\ \hline Number of unique IP address & 11 & 45 & 16,960 & 7991 \\ Simulation & Yes & Yes & Partial & Partial & \\ Duration of the data being captured & 5 weeks & 16 h & 65 h & 39 h \\ Format of the data collected & 3 types (tcpdump, BSM, dumpfile) & pcap files & pcap files & pcap files & \\ Number of Attack categories & 4 & 9 & 7 & 4 \\ Feature extraction tools & Bro-IDS tool & Argus, Bro-IDS & CICFlowmeter & Zeek-IDS, python tools \\ Number of features & 42 & & 49 & 80 & 86 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: The dataset comparison of KDD99, UNSW-NB15, CICIDS-2017, and HIKARI-2021 [68]. such as complete capture, for which we provide all traces with pcap files (e.g., background traffic, benign, and attack); the payload is provided with the exception that we anonymize the background traffic, while anonymity is part of a requirement to preserve privacy. The ground-truth and labeled are manually evaluated based on the source IP address, source port, destination IP address, destination port, and protocol. This process is to make sure that no unlabeled attack is in the ground-truth. The last requirement is encryption. This one of the most important requirements, as we know that unknown malicious traffic uses these attack vectors to deliver attacks. The second is process requirement. It is to ensure that researchers can follow the guidelines to create their dataset. The information on how to generate the synthetic attacks and the network configuration should be available. We provided the scripts on how to capture and generate the synthetic attacks from the attack profile. The tools for mimicking human interaction, such as browsing and clicking random links, are available.