Table 1 Evolving Attacks in the CICIDS2017 Dataset

Benign

Normal network traffic

Brute force

This attack is used for password cracking as well as the discovery of hidden pages and content in a web application

Heartbleed

The heartbleed attack emanates from a bug in the OpenSSL cryptography library, which is an implementation of the Transport Layer Security (TLS) protocol

Botnet

This attack uses a number of devices connected over the Internet to circumvent and exploit vulnerable machines

DoS

The Denial of Service (DoS) attack temporarily or indefinitely disrupts services on a host machine connected to the Internet. These services then become unavailable to the intended users for the period of the attack

DDoS

Usually results from a botnet of compromised machines flooding the bandwidth or resources of a victim machine

Web

Includes SQL injection, Cross-Site Scripting (XSS) and Brute force over HTTP:

SQL injection is a code injection technique that is used to attack data-driven applications. An attacker can create a string of SQL commands in order to force the database to divulge its contents.

XSS attack allows attackers to inject client-side scripts into web pages, which are viewed by other users.

Brute force over HTTP enables an attacker to try a list of passwords to find the administrator’s password.

Infiltration

This is an attack that exploits the vulnerability of a software in order to execute a backdoor on the victim’s machine. This can lead to attacks such as IP Sweep, port scan and service enumerations.