CICIDS2017 - Comprehensive Network Intrusion Detection Dataset
Catalog Summary
"The most cited cybersecurity dataset worldwide with 2.8+ million network flows capturing 14 types of realistic attack scenarios including DDoS, brute force, botnet, and web attacks alongside benign traffic for advanced intrusion detection systems."
Catalog Notes
Dataset Overview
CICIDS2017 is the gold standard for network intrusion detection research, developed by the Canadian Institute for Cybersecurity. Collected over 5 days from a realistic network environment with both benign and attack traffic.
Attack Types (14 Types)
- DoS/DDoS: Hulk, GoldenEye, Slowloris, SlowHTTPTest, Heartbleed
- Port Scanning: Full port scan, SSH-Patator, FTP-Patator
- Botnet: Botnet traffic simulation
- Web Attacks: Brute Force, XSS, SQL Injection
- Infiltration: Network infiltration attempts
- Brute Force: SSH/FTP password attacks
Key Features & Metrics (80+ Features)
- Flow Duration: Time between first and last packet
- Header Length: Ethernet, IP, TCP/UDP headers
- Protocol: TCP, UDP, ICMP statistics
- Packet Counts: Total, PSH, ACK, URG flags
- Byte Counts: Total, incoming, outgoing bytes
- Inter-Arrival Time: Mean, std, min, max
- Flow Bytes: Per second, per packet ratios
- Packet Length: Mean, std, min, max statistics
- Flags: FIN, SYN, RST, PSH, ACK, URG counts
Dataset Statistics
- Total Flows: 2,830,743 network flows
- Benign Traffic: 2,273,097 flows (80.3%)
- Attack Traffic: 557,646 flows (19.7%)
- Training Days: 3 days (Monday-Wednesday)
- Test Days: 2 days (Thursday-Friday)
Device Types & Environment
- IoT devices (smart home appliances)
- Desktop workstations
- Network servers
- Virtualized environments
- Realistic academic network topology
Research Applications
This dataset powers thousands of cybersecurity research papers annually and is the benchmark for:
- Intrusion Detection Systems (IDS)
- Machine Learning for Cybersecurity
- Deep Learning Anomaly Detection
- Network Traffic Classification
- IoT Security Research
- Zero-Day Attack Detection
Data Format & Structure
- Format: CSV (Machine Generated Traffic, Wednesday, Thursday)
- Features: 80 network flow features + labels
- Size: ~2.5 GB compressed
- Compatibility: Scikit-learn, TensorFlow, PyTorch
License & Usage
Free for academic, research, and commercial use under the CIC dataset license. Widely used in over 5,000 research publications.
View Data Structure
To explore column names, data types, and sample rows, visit the official dataset page on University (Canadian Institute for Cybersecurity).
Preview on University (Canadian Institute for Cybersecurity)Provided Citation
Sharafaldin, I., Lashkari, A. H., & Ghorbani, A. A. (2018). Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. 4th International Conference on Information Systems Security and Privacy (ICISSP), Portugal.
This citation is displayed as supplied. Automatic style conversion is disabled because structured citation metadata is not recorded.
Source metadata: University (Canadian Institute for Cybersecurity) (2026)
Indexed by IoTDataset.com on Jan 20, 2026
Review the Source Record
Confirm the licence, version, access conditions, file format, and provenance at the source before use.