Find research datasets worth reusing

opencc-by-4.0Sep 2021View details →

Data Set of Publication on Detecting Violations of Access Control and Information Flow Policies in Data Flow Diagrams

This data set contains the evaluation data of our publication on "<a href="https://doi.org/10.1016/j.jss.2021.111138">Detecting Violations of Access Control and Information Flow Policies in Data Flow Diagrams</a>". The data set contains an overview on our implementation, description of the evaluation cases, and the evaluation results. The application to produce this data is available in another data set, which is linked to this data set.

Detecting sub-stellar companions using the stellar pulsation timing method

Video introduction to the poster <a href="http://wwwuser.gwdg.de/~felix.mackebrandt/plato21/">Detecting sub-stellar companions using the stellar pulsation timing method</a>

Supplementary data to publication "Cellular detection of the chemokine receptor CXCR4 in bovine mammary glands and its distribution and regulation on bovine leukocytes"

Supplementary data to publication "Cellular detection of the chemokine receptor CXCR4 in bovine mammary glands and its distribution and regulation on bovine leukocytes" in Journal of Dairy Science; https://doi.org/10.3168/jds.2021-20799

Detecting Code Smells in React-based Web Apps

DBR

Automated application to assist in detecting novel gene-disease associations following whole genome sequencing

Results files, analysis scripts and original software from TierUp reanalysis performed on June 2020. These data contribute to the publication titled "Automated reanalysis application to assist in detecting novel gene-disease associations following whole genome sequencing".  <ul> <li> tierup_v0-3-0.tar.gz - source code used in the reanalysis </li> <li> tierup_results_summary.tar.gz - raw data and python code for publication figures </li> </ul>

FIGURE 5 in Detection of cryptic taxa in Leptobrachium nigrops (Amphibia, Anura, Megophryidae), with description of two new species

FIGURE 5. Ventral sides of thigh (top row), hand (middle row), and foot (bottom row) of (A) L. nigrops (KUHE 42243), (B) the holotype of L. ingeri sp. nov. (KUHE 53848), and (C) the holotype of L. kanowitense sp. nov. (KUHE 42575).

FIGURE 4 in Detection of cryptic taxa in Leptobrachium nigrops (Amphibia, Anura, Megophryidae), with description of two new species

FIGURE 4. Ventral views in males (top row) and females (bottom row) of (A) L. nigrops: KUHE 15658 (male) and KUHE 42243 (female); (B) L. ingeri sp. nov.: a paratype (KUHE 53834: male) and the holotype (KUHE 53848: female); (C) L. kanowitense sp. nov.: a paratype (KUHE42574: male) and the holotype (KUHE 42575: female). Scale indicates 5 mm.

FIGURE 1 in Detection of cryptic taxa in Leptobrachium nigrops (Amphibia, Anura, Megophryidae), with description of two new species

FIGURE 1. Map of Malaysia and western part of Indonesia, showing sample localities of the L. nigrops group that are used in the molecular analyses (triangle) and morphological analyses (reversed triangle). Blue: L. nigrops. Yellow: L. ingeri sp. nov. Red: L. kanowitense sp. nov.). Details of localities are shown in Table 1.

FIGURE 3 in Detection of cryptic taxa in Leptobrachium nigrops (Amphibia, Anura, Megophryidae), with description of two new species

FIGURE 3. Three species of the Leptobrachium nigrops group in life. (A) A female of L. nigrops from Malay Peninsula (KUHE 42243); (B) A female paratype of L. ingeri sp. nov. from Santubong (KUHE 53832); (C) A female holotype of L. kanowitense sp. nov. from Kanowit (KUHE 42575).

FIGURE 2 in Detection of cryptic taxa in Leptobrachium nigrops (Amphibia, Anura, Megophryidae), with description of two new species

FIGURE 2. Bayesian trees of a 2426 bp fragments of mtDNA (left) and a 1987 bp fragments of nuDNA (right) for sample of the L. nigrops group (for the sample numbers, see Table 1). Numbers above branches represent bootstrap support for MP and ML, and Bayesian posterior probabilities (MPBS/MLBS/BPP). Asterisks indicate node with full bootstrap supports for MP and ML inference (100%) and Bayesian posterior probabilities (BPP = 1.00).

FIGURE 6 in Detection of cryptic taxa in Leptobrachium nigrops (Amphibia, Anura, Megophryidae), with description of two new species

FIGURE 6. Spectrograms (above) and wave form (below) of advertisement call of (A) L. nigrops (KUHE 15430) from Kuala Lumpur, Malay Peninsula and (B) L. ingeri sp. nov. (KUHE 53834) from Santubong, Sarawak.

opencc-by-4.0May 2018View details →

Shotover River, New Zealand - Geomorphic Change Detection - Example Dataset

A simple<a href="https://gcd.riverscapes.net/Tutorials/example-data-sets.html"> Example GCD Dataset </a>illustrating topographic change detection on the fan of the Shotover River. Great for illustrating GCD with rather large datasets. <ul> <li>2.5km gravel bed, braided river near  <a href="https://www.google.com/maps/place/45%C2%B000'35.1%22S+168%C2%B045'56.3%22E/@-45.0103208,168.7612985,3923m/data=!3m1!1e3!4m5!3m4!1s0x0:0x0!8m2!3d-45.009756!4d168.765638">Queenstown, New Zealand</a></li> <li>Two LiDAR surveys</li> <li>1m cell resolution</li> </ul> Dataset includes raw data to run exercises, as well as full *.gcd projects that can be opened.

opencc-by-4.0May 2018View details →

River Dee, Scotland - Geomorphic Change Detection - Example Dataset

A simple<a href="https://gcd.riverscapes.net/Tutorials/example-data-sets.html"> Example GCD Dataset </a>illustrating topographic change detection following a major flood in Scotland. Used in the <a href="https://gcd.riverscapes.net/Workshops/2018/Aberdeen/">GeoTerm Aberdeen Workshop</a>. Dataset is from: <ul> <li>6km of channel near  <a href="https://www.google.com/maps/place/57%C2%B002'53.9%22N+3%C2%B003'09.3%22W/@57.0490441,-3.0938372,8093m/data=!3m1!1e3!4m5!3m4!1s0x0:0x0!8m2!3d57.048317!4d-3.052569">Ballater, Scotland</a></li> <li>Two LiDAR surveys</li> <li>1m cell resolution</li> </ul> Dataset includes raw data to run exercises, as well as full *.gcd projects that can be opened.

opencc-by-4.0Oct 2022View details →

DomainNet: Homograph Detection and Understanding in Data Lake Disambiguation

Datasets and their graph representations used for the: "DomainNet: Homograph Detection and Understanding in Data Lake Disambiguation" paper submission

opencc-by-4.0Oct 2022View details →

Trojan Detection Challenge - Final Round Dataset

This contains the dataset for the Final Round of the Trojan Detection Challenge NeurIPS 2022 competition. To learn more, please see the <a href="http://trojandetection.ai/">competition website</a>.

Dataset for Weather drives variation in COVID-19 transmission and detection

This dataset contains the input data for the panel regression and SEIR analyses for the paper "Weather drives variation in COVID-19 transmission and detection", as well as the results of the SEIR calibrations. Under the `inputs` directory, the `panel_all.csv` data provides the compiled data for the core analyses. For information on COVID cases, we use daily reports from the John Hopkins University's COVID-19 Data Repository by the Center for Systems Science and Engineering (CSSE) (Dong et al. 2020). We complement these data with a variety of online sources on confirmed cases at the subnational level. For information on weather, we use ERA 5 reanalysis (Hersbach et al. 2018). The data were downloaded from the Copernicus Climate Change Service (C3S) Climate Data Store in January 2021. The governance data (in `inputs/governance`) is drawn from <a href="https://info.worldbank.org/governance/wgi/">https://info.worldbank.org/governance/wgi/</a> for the year 2019. The mapping is done using GADM 3.6, simplified to reduce its size, and stored in `inputs/gadm36_levels_simple`. The result data in the `results` directory represents calibrations of the Bayesian SEIR model:  - Files of the form `epimodel-meta-0314...-nodel.csv` include parameter estimates both as initially calibrated (group = "Raw") and after the meta-analysis (group = "Combined"). Paramater estimates are represented by their mean, standard deviation, and five quantiles. Different files of this form reflect different assumptions: (1) `-noweather` exclude weather effects; `-noprior` exclude panel regression priors, and `-full3` include weather and priors; (2) `-all` were estimated using all observations; `-mobile` were estimated using only region/observations with mobility data; (3) `-nobs` include meta-analyzed data weighted by the number of observations; `-pop` are weighted by population; and `-region` are weighted by region.  - The `global-0314.RData` file contains calibrations treating the whole world as one region.  - The `pairwise.csv` and `pairwise-all.csv` compare data from regions that have valid no-prior (suffix 1) and no-weather (suffix 2) projections. `pairwise.csv` has summary statistics while `pairwise-all.csv` includes every region. Acknowledgements: The results contain modified Copernicus Climate Change Service information 2020. Neither the European Commission nor ECMWF is responsible for any use that may be made of the Copernicus information or data it contains. Bibliography: Dong E, Du H, Gardner L (2020): An interactive web-based dashboard to track COVID-19 in real time. Lancet Inf Dis. 20(5):533-534. doi: 10.1016/S1473-3099(20)30120-1 Hersbach, H., Bell, B., Berrisford, P., Biavati, G., Horányi, A., Muñoz Sabater, J., Nicolas, J., Peubey, C., Radu, R., Rozum, I., Schepers, D., Simmons, A., Soci, C., Dee, D., Thépaut, J-N. (2018): ERA5 hourly data on single levels from 1959 to present. Copernicus Climate Change Service (C3S) Climate Data Store (CDS). (Accessed in January 2021), 10.24381/cds.adbb2d47

Bimodal Detection Task Dataset

Bimodal Detection Task Database. This database contains the spikes recorded in subareas  3b and 1 in the primary somatosensory cortex.   For more details about the task see the main paper: Hierarchical unimodal processing within the primary somatosensory cortex during a bimodal detection task Sergio Parra, Héctor Diaz, Antonio Zainos, Manuel Alvarez, Jerónimo Zizumbo, Sebastián Pujalte, Lucas Bayones, Ranulfo Romo, Román Rossi-Pool bioRxiv 2022.08.12.503802; doi: https://doi.org/10.1101/2022.08.12.503802

Anomaly Detection Algorithm Performance

Anomaly detection algorithms performance metrics: AUC and Average precision; two sets of 298 + 13 algorithms; 9315 datasets.

opencc-by-4.0Dec 2021View details →

DNP3 Intrusion Detection Dataset

1.Introduction In the digital era of the Industrial Internet of Things (IIoT), the conventional Critical Infrastructures (CIs) are transformed into smart environments with multiple benefits, such as pervasive control, self-monitoring and self-healing. However, this evolution is characterised by several cyberthreats due to the necessary presence of insecure technologies. DNP3 is an industrial communication protocol which is widely adopted in the CIs of the US. In particular, DNP3 allows the remote communication between Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA). It can support various topologies, such as Master-Slave, Multi-Drop, Hierarchical and Multiple-Server. Initially, the architectural model of DNP3 consists of three layers: (a) Application Layer, (b) Transport Layer and (c) Data Link Layer. However, DNP3 can be now incorporated into the Transmission Control Protocol/Internet Protocol (TCP/IP) stack as an application-layer protocol. However, similarly to other industrial protocols (e.g., Modbus and IEC 60870-5-104), DNP3 is characterised by severe security issues since it does not include any authentication or authorisation mechanisms. More information about the DNP3 security issue is provided in [1-3]. This dataset contains labelled Transmission Control Protocol (TCP) / Internet Protocol (IP) network flow statistics (Common-Separated Values - CSV format) and DNP3 flow statistics (CSV format) related to 9 DNP3 cyberattacks. These cyberattacks are focused on DNP3 unauthorised commands and Denial of Service (DoS). The network traffic data are provided through Packet Capture (PCAP) files. Consequently, this dataset can be used to implement Artificial Intelligence (AI)-powered Intrusion Detection and Prevention (IDPS) systems that rely on Machine Learning (ML) and Deep Learning (DL) techniques. 2.Instructions This DNP3 Intrusion Detection Dataset was implemented following the methodological frameworks of A. Gharib et al. in [4] and S. Dadkhah et al in [5], including eleven features: (a) Complete Network Configuration, (b) Complete Traffic, (c) Labelled Dataset, (d) Complete Interaction, (e) Complete Capture, (f) Available Protocols, (g) Attack Diversity, (h) Heterogeneity, (i) Feature Set and (j) Metadata. A network topology consisting of (a) eight industrial entities, (b) one Human Machine Interfaces (HMI) and (c) three cyberattackers was used to implement this DNP3 Intrusion Detection Dataset. In particular, the following cyberattacks were implemented. <ul> <li>On Thursday, May 14, 2020, the DNP3 Disable Unsolicited Messages Attack was executed for 4 hours.</li> <li>On Friday, May 15, 2020, the DNP3 Cold Restart Message Attack was executed for 4 hours.</li> <li>On Friday, May 15, 2020, the DNP3 Warm Restart Message Attack was executed for 4 hours.</li> <li>On Saturday, May 16, 2020, the DNP3 Enumerate Attack was executed for 4 hours.</li> <li>On Saturday, May 16, 2020, the DNP3 Info Attack was executed for 4 hours.</li> <li>On Monday, May 18, 2020, the DNP3 Initialisation Attack was executed for 4 hours.</li> <li>On Monday, May 18, 2020, the Man In The Middle (MITM)-DoS Attack was executed for 4 hours.</li> <li>On Monday, May 18, 2020, the DNP3 Replay Attack was executed for 4 hours.</li> <li>On Tuesday, May 19, 2020, the DNP3 Stop Application Attack was executed for 4 hours.</li> </ul> The aforementioned DNP3 cyberattacks were executed, utilising penetration testing tools, such as Nmap and Scapy. For each attack, a relevant folder is provided, including the network traffic and the network flow statistics for each entity. In particular, for each cyberattack, a folder is given, providing (a) the pcap files for each entity, (b) the Transmission Control Protocol (TCP)/ Internet Protocol (IP) network flow statistics for 120 seconds in a CSV format and (c) the DNP3 flow statistics for each entity (using different timeout values in terms of second (such as 45, 60, 75, 90, 120 and 240 seconds)). The TCP/IP network flow statistics were produced by using the CICFlowMeter, while the DNP3 flow statistics were generated based on a Custom DNP3 Python Parser, taking full advantage of Scapy. 3. Dataset Structure The dataset consists of the following folders: <ul> <li>20200514_DNP3_Disable_Unsolicited_Messages_Attack: It includes the pcap and CSV files related to the DNP3 Disable Unsolicited Message attack.</li> <li>20200515_DNP3_Cold_Restart_Attack: It includes the pcap and CSV files related to the DNP3 Cold Restart attack.</li> <li>20200515_DNP3_Warm_Restart_Attack: It includes the pcap and CSV files related to DNP3 Warm Restart attack.</li> <li>20200516_DNP3_Enumerate: It includes the pcap and CSV files related to the DNP3 Enumerate attack.</li> <li>20200516_DNP3_Ιnfo: It includes the pcap and CSV files related to the DNP3 Info attack.</li> <li>20200518_DNP3_Initialize_Data_Attack: It includes the pcap and CSV files related to the DNP3 Data Initialisation attack.</li> <li>20200518_DNP3_MITM_DoS: It includes the pcap and CSV files related to the DNP3 MITM-DoS attack.</li> <li>20200518_DNP3_Replay_Attack: It includes the pcap and CSV files related to the DNP3 replay attack.</li> <li>20200519_DNP3_Stop_Application_Attack: It includes the pcap and CSV files related to the DNP3 Stop Application attack.</li> <li>Training_Testing_Balanced_CSV_Files: It includes balanced CSV files from CICFlowMeter and the Custom DNP3 Python Parser that could be utilised for training ML and DL methods. Each folder includes different sub-folder for the corresponding flow timeout values used by the DNP3 Python Custom Parser. For CICFlowMeter, only the timeout value of 120 seconds was used.</li> </ul> Each folder includes respective subfolders related to the entities/devices (described in the following section) participating in each attack. In particular, for each entity/device, there is a folder including (a) the DNP3 network traffic (pcap file) related to this entity/device during each attack, (b) the TCP/IP network flow statistics (CSV file) generated by CICFlowMeter for the timeout value of 120 seconds and finally (c) the DNP3 flow statistics (CSV file) from the Custom DNP3 Python Parser. Finally, it is noteworthy that the network flows from both CICFlowMeter and Custom DNP3 Python Parser in each CSV file are labelled based on the DNP3 cyberattacks executed for the generation of this dataset. The description of these attacks is provided in the following section, while the various features from CICFlowMeter and Custom DNP3 Python Parser are presented in Section 5. 4.Testbed & DNP3 Attacks The following figure shows the testbed utilised for the generation of this dataset. It is composed of eight industrial entities that play the role of the DNP3 outstations/slaves, such as Remote Terminal Units (RTUs) and Intelligent Electron Devices (IEDs). Moreover, there is another workstation which plays the role of the Master station like a Master Terminal Unit (MTU). For the communication between, the DNP3 outstations/slaves and the master station, opendnp3 was used.   Table 1: DNP3 Attacks Description <table> <tbody> <tr> <td> DNP3 Attack </td> <td> Description </td> <td> Dataset Folder </td> </tr> <tr> <td> DNP3 Disable Unsolicited Message Attack </td> <td> This attack targets a DNP3 outstation/slave, establishing a connection with it, while acting as a master station. The false master then transmits a packet with the DNP3 Function Code 21, which requests to disable all the unsolicited messages on the target. </td> <td> 20200514_DNP3_Disable_Unsolicited_Messages_Attack </td> </tr> <tr> <td> DNP3 Cold Restart Attack </td> <td> The malicious entity acts as a master station and sends a DNP3 packet that includes the “Cold Restart” function code. When the target receives this message, it initiates a complete restart and sends back a reply with the time window before the restart process. </td> <td> 20200515_DNP3_Cold_Restart_Attack </td> </tr> <tr> <td> DNP3 Warm Restart Attack </td> <td> This attack is quite similar to the “Cold Restart Message”, but aims to trigger a partial restart, re-initiating a DNP3 service on the target outstation. </td> <td> 20200515_DNP3_Warm_Restart_Attack </td> </tr> <tr> <td> DNP3 Enumerate Attack </td> <td> This reconnaissance attack aims to discover which DNP3 services and functional codes are used by the target system. </td> <td> 20200516_DNP3_Enumerate </td> </tr> <tr> <td> DNP3 Info Attack </td> <td> This attack constitutes another reconnaissance attempt, aggregating various DNP3 diagnostic information related the DNP3 usage. </td> <td> 20200516_DNP3_Ιnfo </td> </tr> <tr> <td> Data Initialisation Attack </td> <td> This cyberattack is related to Function Code 15 (Initialize Data). It is an unauthorised access attack, which demands from the slave to re-initialise possible configurations to their initial values, thus changing potential values defined by legitimate masters </td> <td> 20200518_Initialize_Data_Attack </td> </tr> <tr> <td> MITM-DoS Attack </td> <td> In this cyberattack, the cyberattacker is placed between a DNP3 master and a DNP3 slave device, dropping all the messages coming from the DNP3 master or the DNP3 slave. </td> <td> 20200518_MITM_DoS </td> </tr> <tr> <td> DNP3 Replay Attack </td> <td> This cyberattack replays DNP3 packets coming from a legitimate DNP3 master or DNP3 slave. </td> <td> 20200518_DNP3_Replay_Attack </td> </tr> <tr> <td> DNP3 Step Application Attack </td> <td> This attack is related to the Function Code 18 (Stop Application) and demands from the slave to stop its function so that the slave cannot receive messages from the master. </td> <td> 20200519_DNP3_Stop_Application_Attack </td> </tr> </tbody> </table>   5. Features The TCP/IP network flow statistics generated by CICFlowMeter are summarised below. The TCP/IP network flows and their statistics generated by CICFlowMeter are labelled based on the DNP3 attacks described above, thus allowing the training of ML/DL models. Finally, it is worth mentioning that these statistics are generated when the flow timeout value is equal with 120 seconds. Table 2: CICFlowMeter TCP/IP Network Flow Statistics - Features <table> <tbody> <tr> <td> Feature </td> <td> Description </td> </tr> <tr> <td> Flow ID </td> <td> ID of the flow </td> </tr> <tr> <td> Src IP </td> <td> Source IP address </td> </tr> <tr> <td> Src Port </td> <td> Source TCP/UDP port </td> </tr> <tr> <td> Dst IP </td> <td> Destination IP address </td> </tr> <tr> <td> Dst Port </td> <td> Destination TCP/UDP port </td> </tr> <tr> <td> Protocol </td> <td> The protocol related to the corresponding flow </td> </tr> <tr> <td> Timestamp </td> <td> Flow timestamp </td> </tr> <tr> <td> Flow Duration </td> <td> Duration of the flow in Microsecond </td> </tr> <tr> <td> Tot Fwd Pkts </td> <td> Total packets in the forward direction </td> </tr> <tr> <td> Tot Bwd Pkts </td> <td> Total packets in the backward direction </td> </tr> <tr> <td> TotLen Fwd Pkts </td> <td> Total size of packets in forward direction </td> </tr> <tr> <td> TotLen Bwd Pkts </td> <td> Total size of packets in backward direction </td> </tr> <tr> <td> Fwd Pkt Len Max </td> <td> Maximum size of packet in forward direction </td> </tr> <tr> <td> Fwd Pkt Len Min </td> <td> Minimum size of packet in forward direction </td> </tr> <tr> <td> Fwd Pkt Len Mean </td> <td> Mean size of packet in forward direction </td> </tr> <tr> <td> Fwd Pkt Len Std </td> <td> Standard deviation size of packet in forward direction </td> </tr> <tr> <td> Bwd Pkt Len Max </td> <td> Maximum size of packet in backward direction </td> </tr> <tr> <td> Bwd Pkt Len Min </td> <td> Minimum size of packet in backward direction </td> </tr> <tr> <td> Bwd Pkt Len Mean </td> <td> Mean size of packet in backward direction </td> </tr> <tr> <td> Bwd Pkt Len Std </td> <td> Standard deviation size of packet in backward direction </td> </tr> <tr> <td> Flow Byts/s </td> <td> Number of flow bytes per second </td> </tr> <tr> <td> Flow Pkts/s </td> <td> Number of flow packets per second </td> </tr> <tr> <td> Flow IAT Mean </td> <td> Mean time between two packets sent in the flow </td> </tr> <tr> <td> Flow IAT Std </td> <td> Standard deviation time between two packets sent in the flow </td> </tr> <tr> <td> Flow IAT Max </td> <td> Maximum time between two packets sent in the flow </td> </tr> <tr> <td> Flow IAT Min </td> <td> Minimum time between two packets sent in the flow </td> </tr> <tr> <td> Fwd IAT Tot </td> <td> Total time between two packets sent in the forward direction </td> </tr> <tr> <td> Fwd IAT Mean </td> <td> Mean time between two packets sent in the forward direction </td> </tr> <tr> <td> Fwd IAT Std </td> <td> Standard deviation time between two packets sent in the forward direction </td> </tr> <tr> <td> Fwd IAT Max </td> <td> Maximum time between two packets sent in the forward direction </td> </tr> <tr> <td> Fwd IAT Min </td> <td> Minimum time between two packets sent in the forward direction </td> </tr> <tr> <td> Bwd IAT Tot </td> <td> Total time between two packets sent in the backward direction </td> </tr> <tr> <td> Bwd IAT Mean </td> <td> Mean time between two packets sent in the backward direction </td> </tr> <tr> <td> Bwd IAT Std </td> <td> Standard deviation time between two packets sent in the backward direction </td> </tr> <tr> <td> Bwd IAT Max </td> <td> Maximum time between two packets sent in the backward direction </td> </tr> <tr> <td> Bwd IAT Min </td> <td> Minimum time between two packets sent in the backward direction </td> </tr> <tr> <td> Fwd PSH Flags </td> <td> Number of times the PSH flag was set in packets travelling in the forward direction (0 for UDP) </td> </tr> <tr> <td> Bwd PSH Flags </td> <td> Number of times the PSH flag was set in packets travelling in the backward direction (0 for UDP) </td> </tr> <tr> <td> Fwd URG Flags </td> <td> Number of times the URG flag was set in packets travelling in the forward direction (0 for UDP) </td> </tr> <tr> <td> Bwd URG Flags </td> <td> Number of times the URG flag was set in packets travelling in the backward direction (0 for UDP) </td> </tr> <tr> <td> Fwd Header Len </td> <td> Total bytes used for headers in the forward direction </td> </tr> <tr> <td> Bwd Header Len </td> <td> Total bytes used for headers in the backward direction </td> </tr> <tr> <td> Fwd Pkts/s </td> <td> Number of forward packets per second </td> </tr> <tr> <td> Bwd Pkts/s </td> <td> Number of backward packets per second </td> </tr> <tr> <td> Pkt Len Min </td> <td> Minimum length of a packet </td> </tr> <tr> <td> Pkt Len Max </td> <td> Maximum length of a packet </td> </tr> <tr> <td> Pkt Len Mean </td> <td> Mean length of a packet </td> </tr> <tr> <td> Pkt Len Std </td> <td> Standard deviation length of a packet </td> </tr> <tr> <td> Pkt Len Var </td> <td> Variance length of a packet </td> </tr> <tr> <td> FIN Flag Cnt </td> <td> Number of packets with FIN </td> </tr> <tr> <td> SYN Flag Cnt </td> <td> Number of packets with SYN </td> </tr> <tr> <td> RST Flag Cnt </td> <td> Number of packets with RST </td> </tr> <tr> <td> PSH Flag Cnt </td> <td> Number of packets with PUSH </td> </tr> <tr> <td> ACK Flag Cnt </td> <td> Number of packets with ACK </td> </tr> <tr> <td> URG Flag Cnt </td> <td> Number of packets with URG </td> </tr> <tr> <td> CWE Flag Count </td> <td> Number of packets with CWE </td> </tr> <tr> <td> ECE Flag Cnt </td> <td> Number of packets with ECE </td> </tr> <tr> <td> Down/Up Ratio </td> <td> Download and upload ratio </td> </tr> <tr> <td> Pkt Size Avg </td> <td> Average size of packet </td> </tr> <tr> <td> Fwd Seg Size Avg </td> <td> Average size observed in the forward direction </td> </tr> <tr> <td> Bwd Seg Size Avg </td> <td> Average size observed in the backward direction </td> </tr> <tr> <td> Fwd Byts/b Avg </td> <td> Average number of bytes bulk rate in the forward direction </td> </tr> <tr> <td> Fwd Pkts/b Avg </td> <td> Average number of packets bulk rate in the forward direction </td> </tr> <tr> <td> Fwd Blk Rate Avg </td> <td> Average number of bulk rate in the forward direction </td> </tr> <tr> <td> Bwd Byts/b Avg </td> <td> Average number of bytes bulk rate in the backward direction </td> </tr> <tr> <td> Bwd Pkts/b Avg </td> <td> Average number of packets bulk rate in the backward direction </td> </tr> <tr> <td> Bwd Blk Rate Avg </td> <td> Average number of bulk rate in the backward direction </td> </tr> <tr> <td> Subflow Fwd Pkts </td> <td> The average number of packets in a sub flow in the forward direction </td> </tr> <tr> <td> Subflow Fwd Byts </td> <td> The average number of bytes in a sub flow in the forward direction </td> </tr> <tr> <td> Subflow Bwd Pkts </td> <td> The average number of packets in a sub flow in the backward direction </td> </tr> <tr> <td> Subflow Bwd Byts </td> <td> The average number of bytes in a sub flow in the backward direction </td> </tr> <tr> <td> Init Fwd Win Byts </td> <td> The total number of bytes sent in initial window in the forward direction </td> </tr> <tr> <td> Init Bwd Win Byts </td> <td> The total number of bytes sent in initial window in the backward direction </td> </tr> <tr> <td> Fwd Act Data Pkts </td> <td> Count of packets with at least 1 byte of TCP data payload in the forward direction </td> </tr> <tr> <td> Fwd Seg Size Min </td> <td> Minimum segment size observed in the forward direction </td> </tr> <tr> <td> Active Mean </td> <td> Mean time a flow was active before becoming idle </td> </tr> <tr> <td> Active Std </td> <td> Standard deviation time a flow was active before becoming idle </td> </tr> <tr> <td> Active Max </td> <td> Maximum time a flow was active before becoming idle </td> </tr> <tr> <td> Active Min </td> <td> Minimum time a flow was active before becoming idle </td> </tr> <tr> <td> Idle Mean </td> <td> Mean time a flow was idle before becoming active </td> </tr> <tr> <td> Idle Std </td> <td> Standard deviation time a flow was idle before becoming active </td> </tr> <tr> <td> Idle Max </td> <td> Maximum time a flow was idle before becoming active </td> </tr> <tr> <td> Idle Min </td> <td> Minimum time a flow was idle before becoming active </td> </tr> <tr> <td> Label </td> <td> Attack label </td> </tr> </tbody> </table> The DNP3 flow statistics generated by the DNP3 Python Parser are summarised below. The DNP3 flows and their statistics generated by the DNP3 Python Parser are labelled based on the DNP3 attacks described above, thus allowing the training of ML/DL models. Finally, it is worth mentioning that these statistics are available for various flow timeout values, such as 45, 60, 75, 90, 120 and 240 seconds. Table 3: DNP3 Flow Statistics – Features <table> <tbody> <tr> <td> Feature </td> <td> Field description </td> </tr> <tr> <td> flow ID </td> <td> ID of the flow </td> </tr> <tr> <td> source IP </td> <td> Source IP address </td> </tr> <tr> <td> destination IP </td> <td> Destination IP address </td> </tr> <tr> <td> source port </td> <td> Source TCP/UDP Port </td> </tr> <tr> <td> destination port </td> <td> Destination TCP/UDP port </td> </tr> <tr> <td> protocol </td> <td> The protocol related to the corresponding flow </td> </tr> <tr> <td> date </td> <td> Flow timestamp </td> </tr> <tr> <td> TotalFwdPkts </td> <td> The total number of the DNP3 packets in the forward direction </td> </tr> <tr> <td> TotalBwdPkts </td> <td> The total number of the DNP3 packets in the backyard direction </td> </tr> <tr> <td> TotLenfwdDL </td> <td> The total size of the DNP3 payload at the link layer in the forward direction </td> </tr> <tr> <td> TotLenfwdTR </td> <td> The total size of the DNP3 payload at the transport layer in the forward direction </td> </tr> <tr> <td> TotLenfwdAPP </td> <td> The total size of the DNP3 payload at the application layer in the forward direction </td> </tr> <tr> <td> TotLenbwdDL </td> <td> The total size of the DNP3 payload at the link layer in the backyard direction </td> </tr> <tr> <td> TotLenbwdTR </td> <td> The total size of the DNP3 payload at the transport layer in the backyard direction </td> </tr> <tr> <td> TotLenbwdAPP </td> <td> The total size of the DNP3 payload at the application layer in the backyard direction </td> </tr> <tr> <td> DLfwdPktLenMAX </td> <td> The maximum size of the DNP3 payload at the link layer in the forward direction </td> </tr> <tr> <td> DLfwdPktLenMIN </td> <td> The minimum size of the DNP3 payload at the link layer in the forward direction </td> </tr> <tr> <td> DLfwdPktLenMEAN </td> <td> The mean of the DNP3 payload at the link layer in the forward direction </td> </tr> <tr> <td> DLfwdPktLenSTD </td> <td> The standard deviation of the DNP3 payload at the link layer in the forward direction </td> </tr> <tr> <td> TRfwdPktLenMAX </td> <td> The maximum size of the DNP3 payload at the transport layer in the forward direction </td> </tr> <tr> <td> TRfwdPktLenMIN </td> <td> The minimum size of the DNP3 payload at the transport layer in the forward direction </td> </tr> <tr> <td> TRfwdPktLenMEAN </td> <td> The mean of the DNP3 payload at the transport layer in the forward direction </td> </tr> <tr> <td> TRfwdPktLenSTD </td> <td> The standard deviation of the DNP3 payload at the transport layer in the forward direction </td> </tr> <tr> <td> APPfwdPktLenMAX </td> <td> The maximum size of the DNP3 payload at the application layer in the backyard direction </td> </tr> <tr> <td> APPfwdPktLenMIN </td> <td> The minimum size of the DNP3 payload at the application layer in the backyard direction </td> </tr> <tr> <td> APPfwdPktLenMEAN </td> <td> The mean of the DNP3 payload at the application layer in the backyard direction </td> </tr> <tr> <td> APPfwdPktLenSTD </td> <td> The standard deviation of the DNP3 payload at the application layer in the backyard direction </td> </tr> <tr> <td> DLbwdPktLenMAX </td> <td> The maximum size of the DNP3 payload at the link layer in the backyard direction </td> </tr> <tr> <td> DLbwdPktLenMIN </td> <td> The minimum size of the DNP3 payload at the link layer in the backyard direction </td> </tr> <tr> <td> DLbwdPktLenMEAN </td> <td> The mean of the DNP3 payload at the link layer in the backyard direction </td> </tr> <tr> <td> DLbwdPktLenSTD </td> <td> The standard deviation of the DNP3 payload at the link layer in the backyard direction </td> </tr> <tr> <td> TRbwdPktLenMAX </td> <td> The maximum size of the DNP3 payload at the transport layer in the backyard direction </td> </tr> <tr> <td> TRbwdPktLenMIN </td> <td> The minimum size of the DNP3 payload at the transport layer in the backyard direction </td> </tr> <tr> <td> TRbwdPktLenMEAN </td> <td> The mean of the DNP3 payload at the transport layer in the backyard direction </td> </tr> <tr> <td> TRbwdPktLenSTD </td> <td> The standard deviation of the DNP3 payload at the transport layer in the backyard direction </td> </tr> <tr> <td> APPbwdPktLenMAX </td> <td> The maximum size of the DNP3 payload at the application layer in the backyard direction </td> </tr> <tr> <td> APPbwdPktLenMIN </td> <td> The minimum size of the DNP3 payload at the application layer in the backyard direction </td> </tr> <tr> <td> APPbwdPktLenMEAN </td> <td> The mean of the DNP3 payload at the application layer in the backyard direction </td> </tr> <tr> <td> APPbwdPktLenSTD </td> <td> The standard deviation of the DNP3 payload at the application layer in the backyard direction </td> </tr> <tr> <td> DLflowBytes/sec </td> <td> How many bytes of the DNP3 link-layer were transmitted per second </td> </tr> <tr> <td> TRflowBytes/sec </td> <td> How many bytes of the DNP3 transport layer were transmitted per second </td> </tr> <tr> <td> APPflowBytes/sec </td> <td> How many bytes of the DNP3 application layer were transmitted per second </td> </tr> <tr> <td> FlowPkts/sec </td> <td> How many DNP3 packets were transmitted per second </td> </tr> <tr> <td> FlowIAT_MEAN </td> <td> The mean of the DNP3 packets interarrival time </td> </tr> <tr> <td> FlowIAT_STD </td> <td> The standard deviation of the DNP3 packets interarrival time </td> </tr> <tr> <td> FlowIAT_MAX </td> <td> The maximum value of the DNP3 packets interarrival time </td> </tr> <tr> <td> FlowIAT_MIN </td> <td> The minimum value of the DNP3 packets interarrival time </td> </tr> <tr> <td> TotalFwdIAT </td> <td> The sum of the DNP3 packets interarrival time in the forward direction </td> </tr> <tr> <td> fwdIAT_MEAN </td> <td> The mean of the DNP3 packets interarrival time in the forward direction </td> </tr> <tr> <td> fwdIAT_STD </td> <td> The standard deviation of the DNP3 packets interarrival time in the forward direction </td> </tr> <tr> <td> fwdIAT_MAX </td> <td> The maximum value of the DNP3 packets interarrival time in the forward direction </td> </tr> <tr> <td> fwdIAT_MIN </td> <td> The minimum value of the DNP3 packets interarrival time in the forward direction </td> </tr> <tr> <td> TotalBwdIAT </td> <td> The sum of the DNP3 packets interarrival time in the backyard direction </td> </tr> <tr> <td> bwdIAT_MEAN </td> <td> The mean of the DNP3 packets interarrival time in the backyard direction </td> </tr> <tr> <td> bwdIAT_STD </td> <td> The standard deviation of the DNP3 packets interarrival time in the backyard direction </td> </tr> <tr> <td> bwdIAT_MAX </td> <td> The maximum value of the DNP3 packets interarrival time in the backyard direction </td> </tr> <tr> <td> bwdIAT_MIN </td> <td> The minimum value of the DNP3 packets interarrival time in the backyard direction </td> </tr> <tr> <td> DLfwdHdrLen </td> <td> The sum of the DNP3 headers at the link layer in the forward direction </td> </tr> <tr> <td> TRfwdHdrLen </td> <td> The sum of the DNP3 headers at the transport layer in the forward direction </td> </tr> <tr> <td> APPfwdHdrLen </td> <td> The sum of the DNP3 headers at the application layer in the forward direction </td> </tr> <tr> <td> DLbwdHdrLen </td> <td> The sum of the DNP3 headers at the link layer in the backyard direction </td> </tr> <tr> <td> TRbwdHdrLen </td> <td> The sum of the DNP3 headers at the transport layer in the backyard direction </td> </tr> <tr> <td> APPbwdHdrLen </td> <td> The sum of the DNP3 headers at the application layer in the backyard direction </td> </tr> <tr> <td> fwdPkts/sec </td> <td> How many DNP3 packets per second in the forward direction </td> </tr> <tr> <td> bwdPkts/sec </td> <td> How many DNP3 packets per second in the backyard direction </td> </tr> <tr> <td> DLpktLenMEAN </td> <td> The mean of the bytes at the DNP3 link layer </td> </tr> <tr> <td> DLpktLenMIN </td> <td> The minimum value of the bytes at the DNP3 link layer </td> </tr> <tr> <td> DLpktLenMAX </td> <td> The maximum value of the bytes at the DNP3 link layer </td> </tr> <tr> <td> DLpktLenSTD </td> <td> The standard deviation of the bytes at the DNP3 link layer </td> </tr> <tr> <td> DLpktLenVAR </td> <td> The variance of the bytes at the DNP3 link layer </td> </tr> <tr> <td> TRpktLenMEAN </td> <td> The mean of the bytes at the DNP3 transport layer </td> </tr> <tr> <td> TRpktLenMIN </td> <td> The minimum value of the bytes at the DNP3 transport layer </td> </tr> <tr> <td> TRpktLenMAX </td> <td> The maximum value of the bytes at the DNP3 transport layer </td> </tr> <tr> <td> TRpktLenSTD </td> <td> The standard deviation of the bytes at the DNP3 transport layer </td> </tr> <tr> <td> TRpktLenVAR </td> <td> The variance of the bytes at the DNP3 transport layer </td> </tr> <tr> <td> APPpktLenMEAN </td> <td> The mean of the bytes at the DNP3 application layer </td> </tr> <tr> <td> APPpktLenMIN </td> <td> The minimum value of the bytes at the DNP3 application layer </td> </tr> <tr> <td> APPpktLenMAX </td> <td> The maximum value of the bytes at the DNP3 application layer </td> </tr> <tr> <td> APPpktLenSTD </td> <td> The standard deviation of the bytes at the DNP3 application layer </td> </tr> <tr> <td> APPpktLenVAR </td> <td> The variance of the bytes at the DNP3 application layer </td> </tr> <tr> <td> ActiveMEAN </td> <td> The time-mean where the flow was active </td> </tr> <tr> <td> ActiveSTD </td> <td> The time standard deviation where the flow was active </td> </tr> <tr> <td> ActiveMAX </td> <td> The maximum value of the time where the flow is active </td> </tr> <tr> <td> ActiveMIN </td> <td> The maximum value of the time where the flow is idle. </td> </tr> <tr> <td> IdleMEAN </td> <td> The time-mean where the flow was idle before becoming active </td> </tr> <tr> <td> IdleSTD </td> <td> The standard deviation of the time where the flow was idle before becoming active </td> </tr> <tr> <td> IdleMAX </td> <td> The maximum value of the time where the flow was idle before becoming active </td> </tr> <tr> <td> IdleMIN </td> <td> The minimum value of the time where the flow was idle before becoming active </td> </tr> <tr> <td> frameSrc </td> <td> The source MAC address </td> </tr> <tr> <td> frameDst </td> <td> The destination MAC address </td> </tr> <tr> <td> TotPktsInFlow </td> <td> The total number of the DNP3 packets </td> </tr> <tr> <td> firstPacketDIR </td> <td> Whether the flow was initiated by a DNP3 master device or DNP3 slave device </td> </tr> <tr> <td> mostCommonREQ_FUNC_CODE </td> <td> The DNP3 function code which was used mostly in the DNP3 request packets </td> </tr> <tr> <td> mostCommonRESP_FUNC_CODE </td> <td> The DNP3 function code which was used mostly in the DNP3 response packets </td> </tr> <tr> <td> corruptConfigFragments </td> <td> How many responses were sent by the slave, setting the corruptConfig bit in the IIN value </td> </tr> <tr> <td> deviceTroubleFragments </td> <td> How many responses were sent by the slave, setting the deviceTrouble bit in the IIN value </td> </tr> <tr> <td> deviceRestartFragments </td> <td> How many responses were sent by the slave, setting the deviceRestart bit in the IIN value </td> </tr> <tr> <td> pktsFromMASTER </td> <td> How many packets that transmitted by a DNP3 master device </td> </tr> <tr> <td> pktsFromSLAVE </td> <td> How many packets that transmitted by a DNP3 slave device </td> </tr> <tr> <td> Label </td> <td> Attack label </td> </tr> </tbody> </table> 6.Citation The users of this dataset are kindly asked to cite the following papers as follows. V. Kelli et al., "Attacking and Defending DNP3 ICS/SCADA Systems", 2022 18th International Conference on Distributed Computing in Sensor Systems (DCOSS), 2022, pp. 183-190, doi: 10.1109/DCOSS54816.2022.00041. V. Kelli, P. Radoglou-Grammatikis, T. Lagkas, E. K. Markakis and P. Sarigiannidis, "Risk Analysis of DNP3 Attacks", 2022 IEEE International Conference on Cyber Security and Resilience (CSR), 2022, pp. 351-356, doi: 10.1109/CSR54599.2022.9850291. P. Radoglou-Grammatikis, P. Sarigiannidis, G. Efstathopoulos, P.-A.Karypidis, and A. Sarigiannidis, "Diderot: An intrusion detection and prevention system for dnp3-based scada systems", in Proceedings of the15th International Conference on Availability, Reliability and Security, ser. ARES ’20.New York, NY, USA: Association for Computing Machinery, 2020, doi: 10.1145/3407023.3409314. 7. Acknowledgment This project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreements No 101021936 (ELECTRON) and No 833955 (SDN-microSENSE). References <ol> <li>V. Kelli et al., "Attacking and Defending DNP3 ICS/SCADA Systems", 2022 18th International Conference on Distributed Computing in Sensor Systems (DCOSS), 2022, pp. 183-190, doi: 10.1109/DCOSS54816.2022.00041.</li> <li>V. Kelli, P. Radoglou-Grammatikis, T. Lagkas, E. K. Markakis and P. Sarigiannidis, "Risk Analysis of DNP3 Attacks", 2022 IEEE International Conference on Cyber Security and Resilience (CSR), 2022, pp. 351-356, doi: 10.1109/CSR54599.2022.9850291.</li> <li>P. Radoglou-Grammatikis, P. Sarigiannidis, G. Efstathopoulos, P.-A.Karypidis, and A. Sarigiannidis, "Diderot: An intrusion detection and prevention system for dnp3-based scada systems", in Proceedings of the15th International Conference on Availability, Reliability and Security, ser. ARES ’20.New York, NY, USA: Association for Computing Machinery, 2020, doi: 10.1145/3407023.3409314.</li> <li>A. Gharib, I. Sharafaldin, A. H. Lashkari and A. A. Ghorbani, "An Evaluation Framework for Intrusion Detection Dataset", 2016 International Conference on Information Science and Security (ICISS), 2016, pp. 1-6, doi: 10.1109/ICISSEC.2016.7885840.</li> <li>S. Dadkhah, H. Mahdikhani, P. K. Danso, A. Zohourian, K. A. Truong and A. A. Ghorbani, "Towards the Development of a Realistic Multidimensional IoT Profiling Dataset", 2022 19th Annual International Conference on Privacy, Security & Trust (PST), 2022, pp. 1-11, doi: 10.1109/PST55820.2022.9851966.</li> </ol>

Weakly-Supervised Learning Significantly Reduces the Number of Labels Required for Intracranial Hemorrhage Detection on Head CT

Modern machine learning pipelines, in particular those based on deep learning (DL) models, require large amounts of labeled data. For classification problems, the most common learning paradigm consists of presenting labeled examples during training, thus providing \emph{strong supervision} by directly presenting examples from the different classes, e.g. positive and negative samples. As a result, the adequate training of these models demands the curation of large datasets with high-quality labels. This constitutes a major obstacle for the development of DL models in radiology---in particular for cross-sectional imaging (e.g., computed tomography [CT] scans)---where labels must come from manual annotations by expert radiologists at the image or slice-level (as opposed to the examination level, such as could be obtained using natural language processing of radiology reports).  This work studies the question of what kind of labels should be collected for the problem of intracranial hemorrhage detection in brain CT. We investigate whether image-level annotations should be preferred to examination-level ones. By framing this task as a Multiple Instance Learning (MIL) problem, and employing modern attention-based DL architectures, we analyze the degree to which different levels of supervision improve the detection performance. We find that strong supervision (learning with local image-level annotations) and weak supervision (learning with only global examination-level labels) achieve comparable performance in both examination- and image-level hemorrhage detection, as well as in hemorrhage localization at the pixel-level (explainability). Furthermore, we study this behavior as a function of the number of labels available during training. Our results suggest that local labels may not be necessary at all, drastically reducing the time and cost involved in collecting and curating datasets.