{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,11,19]],"date-time":"2024-11-19T19:06:43Z","timestamp":1732043203327},"reference-count":40,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2024,2,1]],"date-time":"2024-02-01T00:00:00Z","timestamp":1706745600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2023,12,22]],"date-time":"2023-12-22T00:00:00Z","timestamp":1703203200000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100003550","name":"Queensland Government","doi-asserted-by":"publisher","award":["RM2019002409"],"id":[{"id":"10.13039\/501100003550","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Journal of Information Security and Applications"],"published-print":{"date-parts":[[2024,2]]},"DOI":"10.1016\/j.jisa.2023.103689","type":"journal-article","created":{"date-parts":[[2024,1,2]],"date-time":"2024-01-02T12:46:38Z","timestamp":1704199598000},"page":"103689","update-policy":"http:\/\/dx.doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":1,"special_numbering":"C","title":["Benchmarking the benchmark \u2014 Comparing synthetic and real-world Network IDS datasets"],"prefix":"10.1016","volume":"80","author":[{"ORCID":"http:\/\/orcid.org\/0000-0002-1229-2368","authenticated-orcid":false,"given":"Siamak","family":"Layeghy","sequence":"first","affiliation":[]},{"ORCID":"http:\/\/orcid.org\/0000-0002-6694-9572","authenticated-orcid":false,"given":"Marcus","family":"Gallagher","sequence":"additional","affiliation":[]},{"given":"Marius","family":"Portmann","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"10.1016\/j.jisa.2023.103689_b1","series-title":"KDD cup 1999 data","author":"University of California, Irvine","year":"1999"},{"key":"10.1016\/j.jisa.2023.103689_b2","series-title":"Military communications and information systems conference","first-page":"1","article-title":"UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set)","author":"Moustafa","year":"2015"},{"key":"10.1016\/j.jisa.2023.103689_b3","first-page":"108","article-title":"Toward generating a new intrusion detection dataset and intrusion traffic characterization","author":"Sharafaldin","year":"2018","journal-title":"ICISSP 2018 - Proceedings of the 4th international conference on information systems security and privacy, vol. 2018-janua"},{"key":"10.1016\/j.jisa.2023.103689_b4","unstructured":"Moustafa N. New Generations of Internet of Things Datasets for Cybersecurity Applications based Machine Learning: TON_IoT Datasets. In: Proceedings of the EResearch Australasia conference. 2019, p. 21\u20135."},{"key":"10.1016\/j.jisa.2023.103689_b5","series-title":"Big data technologies and applications","isbn-type":"print","doi-asserted-by":"crossref","first-page":"117","DOI":"10.1007\/978-3-030-72802-1_9","article-title":"NetFlow datasets for machine learning-based network intrusion detection systems","author":"Sarhan","year":"2021","ISBN":"http:\/\/id.crossref.org\/isbn\/9783030728021"},{"key":"10.1016\/j.jisa.2023.103689_b6","series-title":"Towards a standard feature set of NIDS datasets","author":"Sarhan","year":"2021"},{"issue":"2","key":"10.1016\/j.jisa.2023.103689_b7","doi-asserted-by":"crossref","first-page":"47","DOI":"10.3390\/e19020047","article-title":"On wasserstein two-sample testing and related families of nonparametric tests","volume":"19","author":"Ramdas","year":"2017","journal-title":"Entropy","ISSN":"http:\/\/id.crossref.org\/issn\/1099-4300","issn-type":"print"},{"issue":"6","key":"10.1016\/j.jisa.2023.103689_b8","doi-asserted-by":"crossref","first-page":"10","DOI":"10.1109\/65.642356","article-title":"Wide-area internet traffic patterns and characteristics","volume":"11","author":"Kevin Thompson","year":"1997","journal-title":"IEEE Netw"},{"issue":"1","key":"10.1016\/j.jisa.2023.103689_b9","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1145\/1012888.1005697","article-title":"Structural analysis of network traffic flows","volume":"32","author":"Anukool Lakhina","year":"2004","journal-title":"SIGMETRICS Perform Eval Rev"},{"key":"10.1016\/j.jisa.2023.103689_b10","series-title":"Proceedings - 2015 2nd international conference on information science and control engineering","isbn-type":"print","first-page":"485","article-title":"Study on the characteristics of network traffic based on STFT","author":"Liu","year":"2015","ISBN":"http:\/\/id.crossref.org\/isbn\/9781467368506"},{"key":"10.1016\/j.jisa.2023.103689_b11","series-title":"Proceedings of the 10th ACM SIGCOMM conference on internet measurement","isbn-type":"print","first-page":"267","article-title":"Network traffic characteristics of data centers in the wild","author":"Theophilus Benson","year":"2010","ISBN":"http:\/\/id.crossref.org\/isbn\/1450304834"},{"key":"10.1016\/j.jisa.2023.103689_b12","doi-asserted-by":"crossref","unstructured":"Kandula S, Sengupta S, Greenberg A, Patel P, Chaiken R. The nature of datacenter traffic: Measurements & analysis. In: Proceedings of the ACM SIGCOMM internet measurement conference. ISBN: 9781605587707, 2009, p. 202\u20138.","DOI":"10.1145\/1644893.1644918"},{"issue":"4","key":"10.1016\/j.jisa.2023.103689_b13","doi-asserted-by":"crossref","first-page":"217","DOI":"10.1145\/1090191.1080118","article-title":"Mining anomalies using traffic feature distributions","volume":"35","author":"Lakhina","year":"2005","journal-title":"SIGCOMM Comput Commun Rev"},{"key":"10.1016\/j.jisa.2023.103689_b14","series-title":"International conference on passive and active network measurement, vol. 4427 LNCS","isbn-type":"print","doi-asserted-by":"crossref","first-page":"22","DOI":"10.1007\/978-3-540-71617-4_3","article-title":"Detectability of traffic anomalies in two adjacent networks","author":"Soule","year":"2007","ISBN":"http:\/\/id.crossref.org\/isbn\/9783540716167"},{"issue":"2","key":"10.1016\/j.jisa.2023.103689_b15","doi-asserted-by":"crossref","first-page":"110","DOI":"10.1109\/TNSM.2009.090604","article-title":"Histogram-based traffic anomaly detection","volume":"6","author":"Andreas Kind","year":"2009","journal-title":"IEEE Trans Netw Serv Manag"},{"issue":"4","key":"10.1016\/j.jisa.2023.103689_b16","doi-asserted-by":"crossref","first-page":"262","DOI":"10.1145\/382912.382923","article-title":"Testing intrusion detection systems: A critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory","volume":"3","author":"Mchugh","year":"2000","journal-title":"ACM Trans Inf Syst Secur","ISSN":"http:\/\/id.crossref.org\/issn\/1557-7406","issn-type":"print"},{"issue":"Ll","key":"10.1016\/j.jisa.2023.103689_b17","doi-asserted-by":"crossref","first-page":"220","DOI":"10.1007\/978-3-540-45248-5_13","article-title":"An analysis of the 1999 DARPA\/Lincoln Laboratory evaluation data for network anomaly detection","volume":"2820","author":"Mahoney","year":"2003","journal-title":"Lecture Notes in Comput Sci","ISSN":"http:\/\/id.crossref.org\/issn\/1611-3349","issn-type":"print"},{"key":"10.1016\/j.jisa.2023.103689_b18","unstructured":"1999 DARPA Intrusion Detection Evaluation Dataset | MIT Lincoln Laboratory."},{"issue":"March 2008","key":"10.1016\/j.jisa.2023.103689_b19","doi-asserted-by":"crossref","first-page":"69730G","DOI":"10.1117\/12.777341","article-title":"Usefulness of DARPA dataset for intrusion detection system evaluation","volume":"6973","author":"Thomas","year":"2008","journal-title":"Data Min Intrusion Detect Inf Assur Data Netw Secur 2008","ISSN":"http:\/\/id.crossref.org\/issn\/0277-786X","issn-type":"print"},{"key":"10.1016\/j.jisa.2023.103689_b20","unstructured":"Roesch M. Snort \u2013 Lightweight Intrusion Detection for Networks. In: Proceedings of LISA 99: 13th systems administration conference. 1999, p. 229\u201338."},{"key":"10.1016\/j.jisa.2023.103689_b21","series-title":"MIT Lincoln Laboratory: DARPA intrusion detection evaluation","year":"2021"},{"key":"10.1016\/j.jisa.2023.103689_b22","doi-asserted-by":"crossref","unstructured":"Tavallaee M, Bagheri E, Lu W, Ghorbani AA. A detailed analysis of the KDD CUP 99 data set. In: 2009 IEEE symposium on computational intelligence for security and defense applications. 2009, p. 1\u20136.","DOI":"10.1109\/CISDA.2009.5356528"},{"issue":"1\u20133","key":"10.1016\/j.jisa.2023.103689_b23","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1080\/19393555.2015.1125974","article-title":"The evaluation of network anomaly detection systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set","volume":"25","author":"Moustafa","year":"2016","journal-title":"Inf Secur J","ISSN":"http:\/\/id.crossref.org\/issn\/1939-3547","issn-type":"print"},{"key":"10.1016\/j.jisa.2023.103689_b24","series-title":"ICISS 2016 - International conference on information science and security 2016, no. cic","isbn-type":"print","first-page":"0","article-title":"An Evaluation Framework for Intrusion Detection Dataset","author":"Gharib","year":"2017","ISBN":"http:\/\/id.crossref.org\/isbn\/9781509054930"},{"key":"10.1016\/j.jisa.2023.103689_b25","doi-asserted-by":"crossref","unstructured":"Dwibedi S, Pujari M, Sun W. A Comparative Study on Contemporary Intrusion Detection Datasets for Machine Learning Research. In: Proceedings - 2020 IEEE international conference on intelligence and security informatics. ISBN: 9781728188003, 2020.","DOI":"10.1109\/ISI49825.2020.9280519"},{"key":"10.1016\/j.jisa.2023.103689_b26","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2021.107840","article-title":"Machine learning methods for cyber security intrusion detection: Datasets and comparative study","author":"Kilincer","year":"2021","journal-title":"Comput Netw","ISSN":"http:\/\/id.crossref.org\/issn\/1389-1286","issn-type":"print"},{"key":"10.1016\/j.jisa.2023.103689_b27","doi-asserted-by":"crossref","first-page":"147","DOI":"10.1016\/j.cose.2019.06.005","article-title":"A survey of network-based intrusion detection data sets","volume":"86","author":"Ring","year":"2019","journal-title":"Comput Secur","ISSN":"http:\/\/id.crossref.org\/issn\/0167-4048","issn-type":"print"},{"key":"10.1016\/j.jisa.2023.103689_b28","series-title":"nProbe, an extensible NetFlow v5\/v9\/IPFIX probe for IPv4\/v6, no. july","first-page":"1","author":"Ntop","year":"2017"},{"issue":"8","key":"10.1016\/j.jisa.2023.103689_b29","doi-asserted-by":"crossref","first-page":"1745","DOI":"10.1109\/TMC.2018.2866249","article-title":"Classifying IoT devices in smart environments using network traffic characteristics","volume":"18","author":"Sivanathan","year":"2019","journal-title":"IEEE Trans Mob Comput","ISSN":"http:\/\/id.crossref.org\/issn\/1558-0660","issn-type":"print"},{"key":"10.1016\/j.jisa.2023.103689_b30","isbn-type":"print","first-page":"326","article-title":"Network attack detection at flow level","author":"Aleksey A. Galtsev","year":"2011","ISBN":"http:\/\/id.crossref.org\/isbn\/9783642228759"},{"key":"10.1016\/j.jisa.2023.103689_b31","series-title":"G-IDS: Generative adversarial networks assisted intrusion detection system","author":"Shahriar","year":"2020"},{"key":"10.1016\/j.jisa.2023.103689_b32","series-title":"Proceedings - 2018 IEEE symposium on security and privacy workshops","isbn-type":"print","first-page":"70","article-title":"Bringing a GAN to a knife-fight: Adapting malware communication to avoid detection","author":"Rigaki","year":"2018","ISBN":"http:\/\/id.crossref.org\/isbn\/9780769563497"},{"key":"10.1016\/j.jisa.2023.103689_b33","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.jnca.2015.11.024","article-title":"Network anomaly detection using IP flows with principal component analysis and ant colony optimization","volume":"64","author":"Gilberto Fernandes","year":"2016","journal-title":"J Netw Comput Appl","ISSN":"http:\/\/id.crossref.org\/issn\/1084-8045","issn-type":"print"},{"key":"10.1016\/j.jisa.2023.103689_b34","doi-asserted-by":"crossref","first-page":"1792","DOI":"10.1109\/ACCESS.2017.2780250","article-title":"HAST-IDS: Learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection","volume":"6","author":"Wang","year":"2017","journal-title":"IEEE Access","ISSN":"http:\/\/id.crossref.org\/issn\/2169-3536","issn-type":"print"},{"key":"10.1016\/j.jisa.2023.103689_b35","series-title":"IEEE INFOCOM 2009, vol. 08544","first-page":"424","article-title":"Rule-based anomaly detection on IP flows","author":"Duffield","year":"2009"},{"key":"10.1016\/j.jisa.2023.103689_b36","series-title":"Kitsune: an ensemble of autoencoders for online network intrusion detection, no. February","first-page":"18","author":"Yisroel Mirsky","year":"2018"},{"key":"10.1016\/j.jisa.2023.103689_b37","series-title":"International workshop on frontiers in algorithmics","isbn-type":"print","doi-asserted-by":"crossref","first-page":"207","DOI":"10.1007\/978-3-642-02270-8_22","article-title":"DDoS attack detection algorithm using IP address features","author":"Jieren Cheng","year":"2009","ISBN":"http:\/\/id.crossref.org\/isbn\/9783642022692"},{"issue":"2","key":"10.1016\/j.jisa.2023.103689_b38","doi-asserted-by":"crossref","first-page":"1153","DOI":"10.1109\/COMST.2015.2494502","article-title":"A survey of data mining and machine learning methods for cyber security intrusion detection","volume":"18","author":"Anna L. Buczak","year":"2016","journal-title":"IEEE Commun Surv Tutor"},{"issue":"4","key":"10.1016\/j.jisa.2023.103689_b39","first-page":"300","article-title":"Comprehensive survey on distance\/similarity measures between probability density functions","volume":"1","author":"Cha","year":"2007","journal-title":"Int J Math Models Methods Appl Sci","ISSN":"http:\/\/id.crossref.org\/issn\/1433-7347","issn-type":"print"},{"key":"10.1016\/j.jisa.2023.103689_b40","series-title":"Wasserstein GAN and the Kantorovich-Rubinstein duality - Vincent Herrmann","author":"Herrmann","year":"2017"}],"container-title":["Journal of Information Security and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S2214212623002739?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S2214212623002739?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2024,1,13]],"date-time":"2024-01-13T17:29:09Z","timestamp":1705166949000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S2214212623002739"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,2]]},"references-count":40,"alternative-id":["S2214212623002739"],"URL":"https:\/\/doi.org\/10.1016\/j.jisa.2023.103689","relation":{},"ISSN":["2214-2126"],"issn-type":[{"value":"2214-2126","type":"print"}],"subject":[],"published":{"date-parts":[[2024,2]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Benchmarking the benchmark \u2014 Comparing synthetic and real-world Network IDS datasets","name":"articletitle","label":"Article Title"},{"value":"Journal of Information Security and Applications","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.jisa.2023.103689","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"Crown Copyright \u00a9 2023 Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"103689"}}