EAGER: C2DIT: Community Continuous Distributed Internet Traffic Datasets

该项目将向一般网络社区提供目前在三个研究和教育网络（RENs）收集的连续、分布式和多模式数据集。这些数据非常适合用于网络安全研究、异常检测、评估和分类任务，如检测DDoS和其他网络攻击、路由劫持、加密应用流量和量化网络弹性。该项目将提供匿名和非匿名数据，后者通过项目现有的基础设施访问。数据的独特性在于其连续、分布、统一和多模性。数据是连续的，因为流量捕获是24/7进行的。这很重要，因为有趣的现象随时都可能发生。数据是分布的和统一的，因为相同的捕获过程同时在所有位置运行。这很重要，因为攻击和其他异常可能是分布的，同时在多个网络中观察它们有助于更容易地进行关联。统一性对于在一致和熟悉的环境中访问数据非常重要。最后，数据将以多种模式呈现：未采样流、sFlow、Netflow，并在某些位置伴有商业入侵检测系统（IDS）警报。每种模式都有自己的优点：发现大海捞针现象需要非采样流；sFlow和Netflow汇总流量，使数据集更小，更容易处理；和IDS警报提供外部DDoS标记。除了使网络安全研究人员受益外，这些数据还将使更广泛的网络社区在路由、审查、流量关联、表征和工程、机器学习、隐私和其他领域的工作受益。这些数据已经在黑客马拉松和课堂上用于构建练习和演示。最后，考虑到互联网在工作、教育和娱乐方面的日益普及，这些数据还将产生广泛的社会影响。数据集可以在https://ant.isi.edu/classnet/This上请求，奖励反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

This project will make available to the general networking community continuous, distributed, and multimode datasets currently being collected at three Research and Education Networks (RENs). The data is well-suited for cybersecurity research, anomaly detection, evaluation, and classification tasks such as detecting DDoS and other network attacks, route hijacking, encrypted application traffic and quantifying network resilience.The project will provide both anonymized and non-anonymized data, the latter accessed through the project’s existing infrastructure. The uniqueness of the data lies in its continuous, distributed, uniform and multimode nature. The data is continuous because traffic capture happens 24/7. This is important because interesting phenomena can happen at any time. The data is distributed and uniform because the same capture process runs at all locations simultaneously. This is important because attacks and other anomalies may be distributed and observing them at multiple networks at the same time facilitates easier correlation. Uniformity is important to access data in a consistent and familiar environment. Finally, the data will be presented in multiple modes: unsampled flows, sFlow, Netflow, and in some locations, accompanied by commercial Intrusion Detection System (IDS) alerts. Each of these modes has its own advantages: unsampled flows are needed to discover needle-in-a-haystack phenomena; sFlow and Netflow summarize traffic making datasets smaller and easier to handle; and IDS alerts provide external DDoS labeling.In addition to benefiting researchers in cybersecurity, the data will benefit the broader networking community working on routing, censorship, traffic correlation, characterization and engineering, machine learning, privacy, and other areas. The data has been used in hackathons and in the classroom to build exercises and demonstrations. Finally, the data will also have a broad societal impact given the increasing use of the Internet for work, education, and entertainment. Datasets may be requested at https://ant.isi.edu/classnet/This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.