In its raw form, the data is unlabeled. You must correlate the timestamps in the bd_116 capture with the official attack schedule provided by the CIC to label flows as "Benign." Security Note
Researchers use this file to extract flow features (like flow duration, packet length, and inter-arrival time) to create a "normal" profile for a network. How to Use the File
It typically contains a subset of "Benign" (normal) network traffic data, which serves as the baseline for identifying anomalies.
Developed by the Canadian Institute for Cybersecurity (CIC) at the University of New Brunswick.
The file is part of a large-scale collection of network traffic captures designed to help researchers train machine learning models to distinguish between benign activity and cyber-attacks.