CICIDS2017-DOS (MB)

This version maintains all six traffic categories found in the PB dataset, including benign traffic and the five DoS attack types: DDoS, DoS GoldenEye, DoS Hulk, DoS Slowloris, and DoS SlowHTTPTest. Unlike the perfectly balanced distribution in the PB dataset, the MB dataset follows the default behaviour of the TUNE sampling framework, where majority classes are reduced to approximately twice the median class size, while minority classes are moderately increased only when needed.

This produces a structured but naturally uneven distribution where attack categories remain present in meaningful proportions without full equalization. All preprocessing steps used in constructing the PB dataset were also applied here, including feature reduction, cleaning, and converting categorical attributes to numeric format. The resulting dataset provides a controlled yet realistic level of imbalance suitable for evaluating model robustness to non-uniform class distributions and for exploring sampling-aware training approaches in intrusion detection research.