{"url":"/dataset/kitsune-network-attack-dataset","name":"Kitsune Network Attack Dataset","full_name":null,"description_markdown":"## Kitsune Network Attack Dataset\r\nThis is a collection of nine network attack datasets captured from a either an IP-based commercial surveillance system or a network full of IoT devices. Each dataset contains millions of network packets and diffrent cyber attack within it.\r\n\r\nFor each attack, you are supplied with:\r\n\r\n* A preprocessed dataset in csv format (ready for machine learning)\r\n* The corresponding label vector in csv format\r\n* The original network capture in pcap format (in case you want to engineer your own features)\r\n\r\nWe will now describe in detail what's in these datasets and how they were collected.\r\n\r\n### The Network Attacks\r\nWe have collected a wide variety of attacks which you would find in a real network intrusion. The following is a list of the cyber attack datasets avalaible:\r\n\r\n\"image\"\r\n\r\nFor more details on the attacks themselves, please refer to our NDSS paper (citation below).\r\n\r\nThe Data Collection\r\nThe following figure presents the network topologies which we used to collect the data, and the corrisponding attack vectors at which the attacks were performed. The network capture took place at point 1 and point X at the router (where a network intrusion detection system could feasibly be placed).\r\nFor each dataset, clean network traffic was captured for the first 1 million packets, then the cyber attack was performed.\r\n\r\n### The Dataset Format\r\nEach preprocessed dataset csv has m rows (packets) and 115 columns (features) with no header. The 115 features were extracted using our AfterImage feature extractor, described in our NDSS paper (see below) and available in Python here.\r\nIn summary, the 115 features provide a statistical snapshot of the network (hosts and behaviors) in the context of the current packet traversing the network. The AfterImage feature extractor is unique in that it can efficiently process millions of streams (network channels) in real-time, incrementally, making it suitable for handling network traffic.\r\n\r\nCitation\r\nIf you use these datasets, please cite:\r\n\r\n```@inproceedings{mirsky2018kitsune, \r\ntitle={Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection},\r\n author={Mirsky, Yisroel and Doitshman, Tomer and Elovici, Yuval and Shabtai, Asaf}, \r\nbooktitle={The Network and Distributed System Security Symposium (NDSS) 2018}, \r\nyear={2018} }```","description_withheld":null,"homepage":"https://www.kaggle.com/datasets/ymirsky/network-attack-dataset-kitsune","introduced_date":"2018-02-25","introduced_date_note":null,"introduced_by":{"paper":"/paper/kitsune-an-ensemble-of-autoencoders-for","title":"Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection","first_author":"Yisroel Mirsky","url":null},"license":{"name":"GNU Affero General Public License","url":null},"modalities":[{"name":"Images","url":"/datasets/modality/images"}],"tasks":[{"name":"Intrusion Detection","url":"/task/intrusion-detection","datasets_with_task":"/datasets/task/intrusion-detection"},{"name":"Network Intrusion Detection","url":"/task/network-intrusion-detection","datasets_with_task":"/datasets/task/network-intrusion-detection"}],"languages":[{"name":"English","url":"/datasets/language/english"}],"variants":["Kitsune Network Attack Dataset"],"data_loaders":[],"num_papers_in_archive":4,"source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28"},"benchmarks":[],"papers_with_a_benchmark_row":[],"syntology_totals":{"read_at":"2026-09-24T18:15:14+00:00","papers_with_samples":0,"samples_harvested":0,"samples_ran":0,"samples_unverified":0,"pointer_only_for_licence":0,"papers_with_no_sample_that_ran":0,"note":"the per-paper counts above, summed; not a rate"},"papers_note":"The archive never published its papers-using-dataset list; these are papers with a leaderboard row on this dataset's benchmarks."}