SDN TCP-SYN Dataset: A dataset for TCP-SYN flood DDoS attack detection in software-defined networks

Area of Science:

• Computer Science
• Network Security
• Cybersecurity

Background:

• Software-Defined Networking (SDN) environments are increasingly vulnerable to sophisticated cyberattacks.
• Distributed Denial of Service (DDoS) attacks, particularly TCP-SYN floods, pose a significant threat to network availability.
• Existing datasets may not adequately represent the complexities of modern network traffic and attack vectors.

Purpose of the Study:

• To introduce and describe the TCP-SYNC SDN dataset, a novel resource for DDoS attack detection research.
• To provide a comprehensive collection of labeled network traffic data, including normal and TCP-SYN flood attack traffic.
• To facilitate advancements in machine learning-based traffic classification and anomaly detection within SDN.

Main Methods:

• The dataset was generated in a controlled testbed environment using Mininet (v2.3.0).
• Real internet traffic from browsing sessions via Google Chrome was captured using Wireshark (v3.0.2).
• Flow-level metrics were collected for both benign and malicious (TCP-SYN flood) traffic scenarios.

Main Results:

• The TCP-SYNC SDN dataset offers labeled, flow-level network traffic data.
• It encompasses both normal traffic patterns and specific TCP-SYN flood attack instances.
• The dataset is validated for its utility in training and evaluating DDoS detection models.

Conclusions:

• The TCP-SYNC SDN dataset is a valuable and publicly available resource for the cybersecurity research community.
• It enables researchers and practitioners to develop and test robust DDoS detection mechanisms for SDN.
• This dataset will accelerate progress in machine learning applications for network security.