CICIDS2017 - Comprehensive Network Intrusion Detection Dataset
Abstract
"The most cited cybersecurity dataset worldwide with 2.8+ million network flows capturing 14 types of realistic attack scenarios including DDoS, brute force, botnet, and web attacks alongside benign traffic for advanced intrusion detection systems."
Description
Dataset Overview
CICIDS2017 is the gold standard for network intrusion detection research, developed by the Canadian Institute for Cybersecurity. Collected over 5 days from a realistic network environment with both benign and attack traffic.
Attack Types (14 Types)
- DoS/DDoS: Hulk, GoldenEye, Slowloris, SlowHTTPTest, Heartbleed
- Port Scanning: Full port scan, SSH-Patator, FTP-Patator
- Botnet: Botnet traffic simulation
- Web Attacks: Brute Force, XSS, SQL Injection
- Infiltration: Network infiltration attempts
- Brute Force: SSH/FTP password attacks
Key Features & Metrics (80+ Features)
- Flow Duration: Time between first and last packet
- Header Length: Ethernet, IP, TCP/UDP headers
- Protocol: TCP, UDP, ICMP statistics
- Packet Counts: Total, PSH, ACK, URG flags
- Byte Counts: Total, incoming, outgoing bytes
- Inter-Arrival Time: Mean, std, min, max
- Flow Bytes: Per second, per packet ratios
- Packet Length: Mean, std, min, max statistics
- Flags: FIN, SYN, RST, PSH, ACK, URG counts
Dataset Statistics
- Total Flows: 2,830,743 network flows
- Benign Traffic: 2,273,097 flows (80.3%)
- Attack Traffic: 557,646 flows (19.7%)
- Training Days: 3 days (Monday-Wednesday)
- Test Days: 2 days (Thursday-Friday)
Device Types & Environment
- IoT devices (smart home appliances)
- Desktop workstations
- Network servers
- Virtualized environments
- Realistic academic network topology
Research Applications
This dataset powers thousands of cybersecurity research papers annually and is the benchmark for:
- Intrusion Detection Systems (IDS)
- Machine Learning for Cybersecurity
- Deep Learning Anomaly Detection
- Network Traffic Classification
- IoT Security Research
- Zero-Day Attack Detection
Data Format & Structure
- Format: CSV (Machine Generated Traffic, Wednesday, Thursday)
- Features: 80 network flow features + labels
- Size: ~2.5 GB compressed
- Compatibility: Scikit-learn, TensorFlow, PyTorch
License & Usage
Free for academic, research, and commercial use under the CIC dataset license. Widely used in over 5,000 research publications.
📊 View Data Structure
To explore column names, data types, and sample rows, visit the official dataset page on University (Canadian Institute for Cybersecurity).
Preview on University (Canadian Institute for Cybersecurity)
Cite This Dataset
University (Canadian Institute for Cybersecurity) (2026). CICIDS2017 - Comprehensive Network Intrusion Detection Dataset. [Dataset]. University (Canadian Institute for Cybersecurity). https://www.unb.ca/cic/datasets/ids-2017.html
Select your preferred citation style above. The citation will automatically update and you can copy it to your clipboard.
Original source: University (Canadian Institute for Cybersecurity) (2026). Visit official page for more details.
Indexed by IoTDataset.com on Jan 20, 2026
Ready to Start Your Research?
Download this dataset directly from the official repository and start building your next breakthrough project.