SSH Username Enumeration Attack Detection Dataset

<p>The dataset is collected from a closed-environment network using network monitoring tools&nbsp;installed in the data collection point. The dataset generation was achieved through the use of common vulnerabilities and exposures (CVE) with the identification number CVE-2018-15473 retrieved from the public exploits database and pcap file of normal traffic obtained from public training repository.&nbsp;&nbsp; A total of 36,273 instances&nbsp;were collected with two classes <em>&ldquo;username enumeration attack&rdquo;</em> and &ldquo;<em>non-username enumeration</em>&rdquo;. &nbsp; We chose the terms <em>&ldquo;username enumeration attack&rdquo;</em> and &ldquo;<em>non-username enumeration</em>&rdquo; instead of the traditional <em>&ldquo;attack&rdquo;</em> and <em>&ldquo;normal&rdquo;</em> label notations since <em>&ldquo;</em>normal<em>&rdquo;</em> traffic data could contain attacks other than username enumeration attack.</p> <p>The username enumeration attack corresponds to the attack traffic while non-username enumeration traffic corresponds to the normal traffic. This traffic reflects different services including emails, DNS, HTTP, web, few to mention. Several data preprocessing techniques&nbsp;were&nbsp;carried out including categorical encoding.&nbsp;Both label encoding and one hot encoding techniques were used to transform categorical feature values into numerical feature values. Hence, two types of datasets were generated.&nbsp;</p>