Trace-Share Dataset for Evaluation of Statistical Characteristics Preservation

The dataset contains all data used during the evaluation of statistical characteristics preservation. Archives are protected by password "trace-share" to avoid false detection by antivirus software.

For more information, see the project repository at https://github.com/Trace-Share.

Selected Attack Traces

We selected 72 different traces of network attacks obtained from various internet databases. File names refer to common names of contained vulnerabilities, malware, or attack tools.

Background Traffic Data

Publicly available dataset CSE-CIC-IDS-2018 was used as a background traffic data. The evaluation uses data from the day Thursday-01-03-2018 containing a sufficient proportion of regular traffic without any statistically significant attacks. Only traffic aimed at victim machines (range 172.31.69.0/24) is used to reduce less significant traffic.

Evaluation Results and Dataset Structure

• Traces variants (traces-normalized.zip, traces-adjusted.zip)
  • ./traces-normalized/ — normalized PCAP files and details in YAML format;
  • ./traces-adjusted/ — configuration files for traces combination in YAML format.
• Computed statistics (statistics.zip)
  • ./statistics-background/ — background traffic statistics computed by ID2T;
  • ./statistics-combination/ — combined traces statistics computed by ID2T for all adjust options (selected only combinations where ID2T provided all statistics files);
  • ./statistics-difference/ — computed mean and median differences of background and combined traffic traces.
• Evaluation results 
  • statistics-difference.ipynb — file containing visualization of statistics differences.