Researchers use this file to extract flow features (like flow duration, packet length, and inter-arrival time) to create a "normal" profile for a network. How to Use the File
Developed by the Canadian Institute for Cybersecurity (CIC) at the University of New Brunswick.
While the data inside bd_116.zip is generally benign, these datasets often contain traces of malware communication or exploit attempts (if you are looking at the attack-day subsets). It is best practice to handle these files in a if you are performing deep packet inspection or executing any embedded payloads for forensic research. bd_116.zip
The file is part of a large-scale collection of network traffic captures designed to help researchers train machine learning models to distinguish between benign activity and cyber-attacks.
Once extracted, the .pcap files can be analyzed using tools like Wireshark, Zeek, or CICFlowMeter. Technical Breakdown Researchers use this file to extract flow features
In the context of the CIC-IDS2017 dataset, bd_116.zip usually refers to one of the raw data segments captured during the 5-day monitoring period.
It typically contains a subset of "Benign" (normal) network traffic data, which serves as the baseline for identifying anomalies. It is best practice to handle these files
Primarily HTTP, HTTPS, FTP, SSH, and standard TCP/UDP background noise.