Building a large, realistic and labeled HTTP URI dataset for anomaly-based intrusion detection systems: Biblio-US17

This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Comm...

Full description

Bibliographic Details
Authors: Díaz Verdejo, Jesús, Estepa Alonso, Rafael María, Estepa Alonso, Antonio José, Muñoz Calle, Francisco Javier, Madinabeitia Luque, Germán
Format: article
Status:Published version
Publication Date:2025
Country:España
Institution:Universidad de Sevilla (US)
Repository:idUS. Depósito de Investigación de la Universidad de Sevilla
OAI Identifier:oai:idus.us.es:11441/174115
Online Access:https://hdl.handle.net/11441/174115
https://doi.org/10.1186/s42400-024-00336-3
Access Level:Open access
Keyword:Anomaly detection
Intrusion detection systems
Data acquisition
Training datasets
Web application flters
Biblio-US17 dataset
id ES_2cd7b2ff0fbd5334a0057d51be4452b4
oai_identifier_str oai:idus.us.es:11441/174115
network_acronym_str ES
network_name_str España
repository_id_str
spelling Building a large, realistic and labeled HTTP URI dataset for anomaly-based intrusion detection systems: Biblio-US17Díaz Verdejo, JesúsEstepa Alonso, Rafael MaríaEstepa Alonso, Antonio JoséMuñoz Calle, Francisco JavierMadinabeitia Luque, GermánAnomaly detectionIntrusion detection systemsData acquisitionTraining datasetsWeb application fltersBiblio-US17 datasetThis article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.This paper introduces Biblio-US17, a labeled dataset collected over 6 months from the log fles of a popular public website at the University of Seville. It contains 47 million records, each including the method, uniform resource identifer (URI) and associated response code and size of every request received by the web server. Records have been classifed as either normal or attack using a comprehensive semi-automated process, which involved signature-based detection, assisted inspection of URIs vocabulary, and substantial expert manual supervision. Unlike comparable datasets, this one ofers a genuine real-world perspective on the normal operation of an active website, along with an unbiased proportion of actual attacks (i.e., non-synthetic). This makes it ideal for evaluating and comparing anomalybased approaches in a realistic environment. Its extensive size and duration also make it valuable for addressing challenges like data shift and insufcient training. This paper describes the collection and labeling processes, dataset structure, and most relevant properties. We also include an example of an application for assessing the performance of a simple anomaly detector. Biblio-US17, now available to the scientifc community, can also be used to model the URIs used by current web servers.SpringerIngeniería TelemáticaTIC154: Departamento de Ingeniería TelemáticaMinisterio de Ciencia e Innovación (MICIN). España2025info:eu-repo/semantics/articleinfo:eu-repo/semantics/publishedVersionapplication/pdfapplication/pdfhttps://hdl.handle.net/11441/174115https://doi.org/10.1186/s42400-024-00336-3reponame:idUS. Depósito de Investigación de la Universidad de Sevillainstname:Universidad de Sevilla (US)InglésCybersecurity, 8, 38.Díaz Verdejo, J., Estepa Alonso, R.M.,...,Madinabeitia Luque, G. (2023). Labeled HTTP requests dataset: Dataset Biblio-US17. idUS. Depósito de Investigación de la Universidad de Sevilla. https://hdl.handle.net/11441/148254.PID2020-115199RBI00https://cybersecurity.springeropen.com/articles/10.1186/s42400-024-00336-3info:eu-repo/semantics/openAccessoai:idus.us.es:11441/1741152026-06-17T12:51:07Z
dc.title.none.fl_str_mv Building a large, realistic and labeled HTTP URI dataset for anomaly-based intrusion detection systems: Biblio-US17
title Building a large, realistic and labeled HTTP URI dataset for anomaly-based intrusion detection systems: Biblio-US17
spellingShingle Building a large, realistic and labeled HTTP URI dataset for anomaly-based intrusion detection systems: Biblio-US17
Díaz Verdejo, Jesús
Anomaly detection
Intrusion detection systems
Data acquisition
Training datasets
Web application flters
Biblio-US17 dataset
title_short Building a large, realistic and labeled HTTP URI dataset for anomaly-based intrusion detection systems: Biblio-US17
title_full Building a large, realistic and labeled HTTP URI dataset for anomaly-based intrusion detection systems: Biblio-US17
title_fullStr Building a large, realistic and labeled HTTP URI dataset for anomaly-based intrusion detection systems: Biblio-US17
title_full_unstemmed Building a large, realistic and labeled HTTP URI dataset for anomaly-based intrusion detection systems: Biblio-US17
title_sort Building a large, realistic and labeled HTTP URI dataset for anomaly-based intrusion detection systems: Biblio-US17
dc.creator.none.fl_str_mv Díaz Verdejo, Jesús
Estepa Alonso, Rafael María
Estepa Alonso, Antonio José
Muñoz Calle, Francisco Javier
Madinabeitia Luque, Germán
author Díaz Verdejo, Jesús
author_facet Díaz Verdejo, Jesús
Estepa Alonso, Rafael María
Estepa Alonso, Antonio José
Muñoz Calle, Francisco Javier
Madinabeitia Luque, Germán
author_role author
author2 Estepa Alonso, Rafael María
Estepa Alonso, Antonio José
Muñoz Calle, Francisco Javier
Madinabeitia Luque, Germán
author2_role author
author
author
author
dc.contributor.none.fl_str_mv Ingeniería Telemática
TIC154: Departamento de Ingeniería Telemática
Ministerio de Ciencia e Innovación (MICIN). España
dc.subject.none.fl_str_mv Anomaly detection
Intrusion detection systems
Data acquisition
Training datasets
Web application flters
Biblio-US17 dataset
topic Anomaly detection
Intrusion detection systems
Data acquisition
Training datasets
Web application flters
Biblio-US17 dataset
description This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.
publishDate 2025
dc.date.none.fl_str_mv 2025
dc.type.none.fl_str_mv info:eu-repo/semantics/article
info:eu-repo/semantics/publishedVersion
format article
status_str publishedVersion
dc.identifier.none.fl_str_mv https://hdl.handle.net/11441/174115
https://doi.org/10.1186/s42400-024-00336-3
url https://hdl.handle.net/11441/174115
https://doi.org/10.1186/s42400-024-00336-3
dc.language.none.fl_str_mv Inglés
language_invalid_str_mv Inglés
dc.relation.none.fl_str_mv Cybersecurity, 8, 38.
Díaz Verdejo, J., Estepa Alonso, R.M.,...,Madinabeitia Luque, G. (2023). Labeled HTTP requests dataset: Dataset Biblio-US17. idUS. Depósito de Investigación de la Universidad de Sevilla. https://hdl.handle.net/11441/148254.
PID2020-115199RBI00
https://cybersecurity.springeropen.com/articles/10.1186/s42400-024-00336-3
dc.rights.none.fl_str_mv info:eu-repo/semantics/openAccess
eu_rights_str_mv openAccess
dc.format.none.fl_str_mv application/pdf
application/pdf
dc.publisher.none.fl_str_mv Springer
publisher.none.fl_str_mv Springer
dc.source.none.fl_str_mv reponame:idUS. Depósito de Investigación de la Universidad de Sevilla
instname:Universidad de Sevilla (US)
instname_str Universidad de Sevilla (US)
reponame_str idUS. Depósito de Investigación de la Universidad de Sevilla
collection idUS. Depósito de Investigación de la Universidad de Sevilla
repository.name.fl_str_mv
repository.mail.fl_str_mv
_version_ 1869405269730000896
score 15,812429

Similar Items