Dataset for CTS-OD: A Cascaded Two-Stage Framework for High-Throughput Obfs4 Detection

Dataset Description

The dataset is organized into two main directories: clearnet and darknet.

Clearnet:
The clearnet directory contains nine subfolders named clearnet_collect1 through clearnet_collect9. Inside each clearnet_collectN folder, all packet capture files and log files have been reorganized into two flat subfolders:

• pcap/ — contains all packet capture files (*.pcap) collected under this mode, such as 1.pcap, 2.pcap, …

• log/ — contains the corresponding traffic log files (*.log), such as 1.log, 2.log, …

The numeric filenames in pcap/ and log/ match one-to-one, meaning that for every N.pcap there is a corresponding N.log representing the same traffic sample.

Darknet:
The darknet directory consists of three subfolders: s0, s1, and s2. Each sN folder contains three client-mode subfolders: c0_sN, c1_sN, and c2_sN. The prefix cX indicates the client's Inter-Arrival-Time (IAT) mode, and the suffix sN indicates the bridge node’s IAT mode.

Each cX_sN folder follows the same reorganized structure as the clearnet folders:

• pcap/ — stores captured packets for this specific client/bridge IAT-mode combination.

• log/ — stores the corresponding textual traffic logs.

Again, filenames are purely numeric and consistent across the two subfolders.

Because the full dataset is extremely large, only the first 100 paired samples (N.pcap and N.log) from each mode are included in the uploaded version, together with the processed statistical feature files extracted from them. Researchers who require access to the complete dataset may contact the corresponding author for data availability and transfer details.