ASNM Datasets: A Collection of Network Traffic Features for Testing of
  Adversarial Classifiers and Network Intrusion Detectors
  In this paper, we present three datasets that have been built from network
traffic traces using ASNM features, designed in our previous work. The first
dataset was built using a state-of-the-art dataset called CDX 2009, while the
remaining two datasets were collected by us in 2015 and 2018, respectively.
These two datasets contain several adversarial obfuscation techniques that were
applied onto malicious as well as legitimate traffic samples during the
execution of particular TCP network connections. Adversarial obfuscation
techniques were used for evading machine learning-based network intrusion
detection classifiers. Further, we showed that the performance of such
classifiers can be improved when partially augmenting their training data by
samples obtained from obfuscation techniques. In detail, we utilized tunneling
obfuscation in HTTP(S) protocol and non-payload-based obfuscations modifying
various properties of network traffic by, e.g., TCP segmentation,
re-transmissions, corrupting and reordering of packets, etc. To the best of our
knowledge, this is the first collection of network traffic metadata that
contains adversarial techniques and is intended for non-payload-based network
intrusion detection and adversarial classification. Provided datasets enable
testing of the evasion resistance of arbitrary classifier that is using ASNM
features.
