In its raw form, the data is unlabeled. You must correlate the timestamps in the bd_116 capture with the official attack schedule provided by the CIC to label flows as "Benign." Security Note
The file is a critical component of the Cyber-Security Research Dataset (CSRD) specifically associated with the CIC-IDS-2017 or CSE-CIC-IDS2018 datasets used for intrusion detection system (IDS) evaluation . It primarily contains raw network traffic data in PCAP format. Overview and Purpose bd_116.zip
Use the CICFlowMeter tool to convert the raw packets into a CSV format containing 80+ network traffic features. In its raw form, the data is unlabeled
While the data inside bd_116.zip is generally benign, these datasets often contain traces of malware communication or exploit attempts (if you are looking at the attack-day subsets). It is best practice to handle these files in a if you are performing deep packet inspection or executing any embedded payloads for forensic research. Overview and Purpose Use the CICFlowMeter tool to
In the context of the CIC-IDS2017 dataset, bd_116.zip usually refers to one of the raw data segments captured during the 5-day monitoring period.
Researchers use this file to extract flow features (like flow duration, packet length, and inter-arrival time) to create a "normal" profile for a network. How to Use the File