{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,25]],"date-time":"2026-04-25T14:33:59Z","timestamp":1777127639983,"version":"3.51.4"},"reference-count":35,"publisher":"MDPI AG","issue":"19","license":[{"start":{"date-parts":[[2023,9,29]],"date-time":"2023-09-29T00:00:00Z","timestamp":1695945600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"US Army Research, Development and Engineering Command Army Research Office","award":["W911NF-19-1-0449"],"award-info":[{"award-number":["W911NF-19-1-0449"]}]},{"name":"US Army Research, Development and Engineering Command Army Research Office","award":["FA8075-18-D-0008"],"award-info":[{"award-number":["FA8075-18-D-0008"]}]},{"name":"US Army Research, Development and Engineering Command Army Research Office","award":["423390-00001"],"award-info":[{"award-number":["423390-00001"]}]},{"name":"US Army Research, Development and Engineering Command Army Research Office","award":["OAC 1827243"],"award-info":[{"award-number":["OAC 1827243"]}]},{"name":"US Army Research, Development and Engineering Command Army Research Office","award":["552456-00000"],"award-info":[{"award-number":["552456-00000"]}]},{"name":"US Army Research, Development and Engineering Command Army Research Office","award":["P120A180114"],"award-info":[{"award-number":["P120A180114"]}]},{"name":"DOD-Air Force Research Laboratory","award":["W911NF-19-1-0449"],"award-info":[{"award-number":["W911NF-19-1-0449"]}]},{"name":"DOD-Air Force Research Laboratory","award":["FA8075-18-D-0008"],"award-info":[{"award-number":["FA8075-18-D-0008"]}]},{"name":"DOD-Air Force Research Laboratory","award":["423390-00001"],"award-info":[{"award-number":["423390-00001"]}]},{"name":"DOD-Air Force Research Laboratory","award":["OAC 1827243"],"award-info":[{"award-number":["OAC 1827243"]}]},{"name":"DOD-Air Force Research Laboratory","award":["552456-00000"],"award-info":[{"award-number":["552456-00000"]}]},{"name":"DOD-Air Force Research Laboratory","award":["P120A180114"],"award-info":[{"award-number":["P120A180114"]}]},{"name":"National Science Foundation","award":["W911NF-19-1-0449"],"award-info":[{"award-number":["W911NF-19-1-0449"]}]},{"name":"National Science Foundation","award":["FA8075-18-D-0008"],"award-info":[{"award-number":["FA8075-18-D-0008"]}]},{"name":"National Science Foundation","award":["423390-00001"],"award-info":[{"award-number":["423390-00001"]}]},{"name":"National Science Foundation","award":["OAC 1827243"],"award-info":[{"award-number":["OAC 1827243"]}]},{"name":"National Science Foundation","award":["552456-00000"],"award-info":[{"award-number":["552456-00000"]}]},{"name":"National Science Foundation","award":["P120A180114"],"award-info":[{"award-number":["P120A180114"]}]},{"name":"Texas Instruments","award":["W911NF-19-1-0449"],"award-info":[{"award-number":["W911NF-19-1-0449"]}]},{"name":"Texas Instruments","award":["FA8075-18-D-0008"],"award-info":[{"award-number":["FA8075-18-D-0008"]}]},{"name":"Texas Instruments","award":["423390-00001"],"award-info":[{"award-number":["423390-00001"]}]},{"name":"Texas Instruments","award":["OAC 1827243"],"award-info":[{"award-number":["OAC 1827243"]}]},{"name":"Texas Instruments","award":["552456-00000"],"award-info":[{"award-number":["552456-00000"]}]},{"name":"Texas Instruments","award":["P120A180114"],"award-info":[{"award-number":["P120A180114"]}]},{"name":"Department of Education","award":["W911NF-19-1-0449"],"award-info":[{"award-number":["W911NF-19-1-0449"]}]},{"name":"Department of Education","award":["FA8075-18-D-0008"],"award-info":[{"award-number":["FA8075-18-D-0008"]}]},{"name":"Department of Education","award":["423390-00001"],"award-info":[{"award-number":["423390-00001"]}]},{"name":"Department of Education","award":["OAC 1827243"],"award-info":[{"award-number":["OAC 1827243"]}]},{"name":"Department of Education","award":["552456-00000"],"award-info":[{"award-number":["552456-00000"]}]},{"name":"Department of Education","award":["P120A180114"],"award-info":[{"award-number":["P120A180114"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Cybersecurity is a critical issue in today\u2019s internet world. Classical security systems, such as firewalls based on signature detection, cannot detect today\u2019s sophisticated zero-day attacks. Machine learning (ML) based solutions are more attractive for their capabilities of detecting anomaly traffic from benign traffic, but to develop an ML-based anomaly detection system, we need meaningful or realistic network datasets to train the detection engine. There are many public network datasets for ML applications. Still, they have limitations, such as the data creation process and the lack of diverse attack scenarios or background traffic. To create a good detection engine, we need a realistic dataset with various attack scenarios and various types of background traffic, such as HTTPs, streaming, and SMTP traffic. In this work, we have developed realistic network data or datasets considering various attack scenarios and diverse background\/benign traffic. Furthermore, considering the importance of distributed denial of service (DDoS) attacks, we have compared the performance of detecting anomaly traffic of some classical supervised and our prior developed unsupervised ML algorithms based on the convolutional neural network (CNN) and pseudo auto-encoder (AE) architecture based on the created datasets. The results show that the performance of the CNN-Pseudo-AE is comparable to that of many classical supervised algorithms. Hence, the CNN-Pseudo-AE algorithm is promising in actual implementation.<\/jats:p>","DOI":"10.3390\/s23198174","type":"journal-article","created":{"date-parts":[[2023,9,29]],"date-time":"2023-09-29T09:39:32Z","timestamp":1695980372000},"page":"8174","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":6,"title":["Data-Driven Network Analysis for Anomaly Traffic Detection"],"prefix":"10.3390","volume":"23","author":[{"given":"Shumon","family":"Alam","sequence":"first","affiliation":[{"name":"Electrical and Computer Engineering Department, Prairie View A&M University, Prairie View, TX 77446, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yasin","family":"Alam","sequence":"additional","affiliation":[{"name":"Department of Physics, University of Texas, Austin, TX 78712, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1152-3272","authenticated-orcid":false,"given":"Suxia","family":"Cui","sequence":"additional","affiliation":[{"name":"Electrical and Computer Engineering Department, Prairie View A&M University, Prairie View, TX 77446, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Cajetan","family":"Akujuobi","sequence":"additional","affiliation":[{"name":"Electrical and Computer Engineering Department, Prairie View A&M University, Prairie View, TX 77446, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2023,9,29]]},"reference":[{"key":"ref_1","unstructured":"(2023, September 13). Internet Crime Report 2022; Federal Bureau of Investigation, U.S. Department of Justice, Available online: https:\/\/www.ic3.gov\/Media\/PDF\/AnnualReport\/2022_IC3Report.pdf."},{"key":"ref_2","unstructured":"(2023, September 13). Astra. Available online: https:\/\/www.getastra.com."},{"key":"ref_3","unstructured":"(2023, September 13). Palo Alto Networks Launches World\u2019s First ML-Powered NGFW. 17 June 2020. Available online: https:\/\/www.paloaltonetworks.com\/company\/press\/2020\/palo-alto-networks-launches-worlds-first-ml-powered-ngfw."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Alam, S., Alam, Y., Cui, S., Akujuobi, C., and Chouikha, M. (2021, January 10\u201312). Toward Developing a Realistic DDoS Dataset for Anomaly-Based Intrusion Detection. Proceedings of the 2021 IEEE International Conference on Consumer Electronics (ICCE), Las Vegas, NV, USA.","DOI":"10.1109\/ICCE50685.2021.9427660"},{"key":"ref_5","unstructured":"(2023, September 13). CyberFlood. Available online: https:\/\/www.spirent.com\/products\/cyberflood-security-test."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Alam, S., Alam, Y., Cui, S., and Akujuobi, C. (2023, January 8\u201311). Unsupervised Network Intrusion Detection Using Convolutional Neural Networks. Proceedings of the IEEE Annual Computing and Communication Workshop and Conference (CCWC), Las Vegas, NV, USA.","DOI":"10.1109\/CCWC57344.2023.10099151"},{"key":"ref_7","unstructured":"(2023, September 13). SECURE Cybersecurity Center of Excellence, Prairie View A&M University. Available online: http:\/\/pvamu1.s3-website-us-east-1.amazonaws.com\/."},{"key":"ref_8","unstructured":"(2023, September 13). Canadian Institute for Cybersecurity. Available online: https:\/\/www.unb.ca\/cic\/datasets\/."},{"key":"ref_9","unstructured":"Lashkari, A.H., Gil, G.D., Mamun, M., and Ghorbani, A. (2017, January 19\u201321). Characterization of Tor Traffic Using Time-Based Features. Proceedings of the 3rd International Conference on Information Systems Security and Privacy (ICISSP), Porto, Portugal."},{"key":"ref_10","unstructured":"(2023, September 13). Darpa Intrusion Detection Evaluation Dataset. Available online: https:\/\/www.ll.mit.edu\/r-d\/datasets\/1998-darpa-intrusion-detection-evaluation-dataset\/."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Thomas, C., Sharma, V., and Balakrishnan, N. (2008, January 17\u201318). Usefulness of DARPA Dataset for Intrusion Detection System Evaluation. Proceedings of the Data Mining, Intrusion Detection, Information Assurance, and Data Networks Security, Orlando, FL, USA.","DOI":"10.1117\/12.777341"},{"key":"ref_12","first-page":"107","article-title":"Unsupervised anomaly detection using an evolutionary extension of k-means algorithm","volume":"2","author":"Lu","year":"2008","journal-title":"Int. J. Inf. Comput. Secur."},{"key":"ref_13","unstructured":"(2023, September 13). KDD CUP 1999: Computer Network Intrusion Detection. Available online: https:\/\/www.kdd.org\/kdd-cup\/view\/kdd-cup-1999\/Data."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A.A. (2009, January 8\u201310). A Detailed Analysis of the KDD CUP 99 Data Set. Proceedings of the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, Ottawa, ON, Canada.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref_15","first-page":"e1954v1","article-title":"A review of KDD99 dataset usage in intrusion detection and machine learning between 2010 and 2015","volume":"4","author":"Erdem","year":"2016","journal-title":"PeerJ Prepr."},{"key":"ref_16","unstructured":"(2023, September 13). NSL-KDD Dataset. Available online: https:\/\/www.unb.ca\/cic\/datasets\/nsl.html."},{"key":"ref_17","unstructured":"(2023, September 13). Gurekddcup Dataset. Available online: www.aldapa.eus\/res\/gureKddcup\/README.pdf."},{"key":"ref_18","unstructured":"Balda, P.I., Gallego, O.A., Goikoetxea, I.G., Mart\u00edn, J.I., Rivero, J.F.M., and de la Fuente, J.M.P. (2023, September 13). Generation of the Database gurekddcup. 10 February 2017. Available online: https:\/\/addi.ehu.es\/bitstream\/handle\/10810\/20608\/20160601_Txostena_gurekddcup_InigoPeronaBalda.pdf?sequence=1&isAllowed=y."},{"key":"ref_19","unstructured":"(2023, September 13). Cyber Defense Exercise (CDX) 2009 Data. Available online: https:\/\/digitalcommons.usmalibrary.org\/aci_datasets\/1\/."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"636","DOI":"10.1016\/j.procs.2020.03.330","article-title":"A Review of the Advancement in Intrusion Detection Datasets","volume":"167","author":"Thakkar","year":"2020","journal-title":"Procedia Comput. Sci."},{"key":"ref_21","unstructured":"(2023, September 13). Traffic Data from Kyoto University\u2019s Honeypots. Available online: https:\/\/www.takakura.com\/Kyoto_data\/."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"184","DOI":"10.1109\/COMST.2015.2402161","article-title":"Intrusion Detection in 802.11 Networks: Empirical Evaluation of Threats and a Public Dataset","volume":"18","author":"Kolias","year":"2016","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_23","unstructured":"(2023, September 13). AWID Dataset. Available online: https:\/\/icsdweb.aegean.gr\/awid\/download-dataset."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection Systems (UNSW-NB15 Networkdata Set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, Autralia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"147","DOI":"10.1016\/j.cose.2019.06.005","article-title":"A Survey of Network-based Intrusion DetectionData Sets","volume":"86","author":"Ring","year":"2019","journal-title":"Comput. Secur."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"357","DOI":"10.1016\/j.cose.2011.12.012","article-title":"Toward developing a systematic approach to generate benchmark datasets for intrusion detection","volume":"31","author":"Shiravi","year":"2012","journal-title":"Comput. Secur."},{"key":"ref_27","unstructured":"(2023, September 13). ASNM-CDX-2009 Dataset. Available online: http:\/\/www.fit.vutbr.cz\/~ihomoliak\/asnm\/ASNM-CDX-2009.html."},{"key":"ref_28","unstructured":"Sangster, B., O\u2019Connor, T.J., Cook, T., Fanelli, R., Dean, E., Adams, W.J., Morrell, C., and Conti, G. (2009, January 10). Toward Instrumenting Network Warfare Competitions to Generate Labeled Datasets. Proceedings of the 2nd Workshop on Cyber Security Experimentation and Test, Montreal, Canada."},{"key":"ref_29","unstructured":"(2023, September 13). Lawrence Berkeley NationalLaboratory (LBNL), ICSI, LBNL\/ICSI Enterprise Tracing Project. Available online: www.icir.org\/enterprise-tracing\/."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"100","DOI":"10.1016\/j.cose.2014.05.011","article-title":"An empirical comparison of botnet detectionmethods","volume":"45","author":"Grill","year":"2014","journal-title":"Comput. Secur."},{"key":"ref_31","unstructured":"Sperotto, A., Sadre, R., Vliet, F.V., and Pras, A. (2009). IP Operations and Management: 9th IEEE International Workshop, IPOM 2009, Venice, Italy, 29\u201330 October 2009, Springer."},{"key":"ref_32","unstructured":"(2023, September 13). Data Collection, Curation and Sharing, Center for Applied Internet Data Analysis. Available online: https:\/\/www.caida.org\/data\/."},{"key":"ref_33","unstructured":"(2023, September 13). Umass Trace Repository, Laboratory for Advanced Software Systems, University of Massachusetts Amherst. Available online: http:\/\/traces.cs.umass.edu\/index.php\/Network\/Network."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, A.H., Hakak, S., and Ghorbani, A.A. (2019, January 1\u20133). Developing Realistic Distributed Denial of Service (DDoS) Attack Dataset and Taxonomy. Proceedings of the 2019 International Carnahan Conference on Security Technology (ICCST), Chennai, India.","DOI":"10.1109\/CCST.2019.8888419"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Falc\u00e3o, F., Tommaso, Z., Silva, C.B.V., Santos, A., Fonseca, B., Ceccarelli, A., and Bondavalli, A. (2019, January 8\u201312). Quantitative Comparison of Unsupervised Anomaly Detection. Proceedings of the 34th ACM\/SIGAPP Symposium on Applied Computing, Limassol, Cyprus.","DOI":"10.1145\/3297280.3297314"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/19\/8174\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T21:02:06Z","timestamp":1760130126000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/19\/8174"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,9,29]]},"references-count":35,"journal-issue":{"issue":"19","published-online":{"date-parts":[[2023,10]]}},"alternative-id":["s23198174"],"URL":"https:\/\/doi.org\/10.3390\/s23198174","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,9,29]]}}}