DDoS Backscatter Dataset

The backscatter traffic are packets the victim generates as a response to the query packets with the spoofed source IP addresses received from the attacker. The uploaded dataset serves to train a classifier which is able to recognize DDoS backscatter traffic from the legitimate traffic.

The csv files contain feature vectors (one feature vector per line) computed per victim DDoS IP addresses. The label feature is called DDOS (DDOS column, True in case the IP address is under DDoS, False otherwise). The IP addresses in the dataset are anonymized by a prefix preserving algorithm.