Datasets used in the StreamSpot experiments
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.

StreamSpot Data

This repository contains the ALL dataset, which includes edges from all the 600 benign and attack scenario graphs. The YDC and GFC datasets can be derived from ALL by picking graph ID's having scenarios as follows:

  • YDC: YouTube, Download, CNN
  • GFC: GMail, VGame, CNN


Tab-separated file with one edge on each line in the following format:

source-id	source-type	destination-id	destination-type	edge-type	graph-id

Graph ID's correspond to scenarios as follows:

  1. YouTube (graph ID's 0 - 99)
  2. GMail (graph ID's 100 - 199)
  3. VGame (graph ID's 200 - 299)
  4. Drive-by-download attack (graph ID's 300 - 399)
  5. Download (graph ID's 400 - 499)
  6. CNN (graph ID's 500 - 599)


The ALL dataset was extracted from the raw flow-graph data using, which performs the following:

  1. Each node and edge type is mapped to a single character.
  2. Consecutive edges between the same pair of nodes corresponding to block-by-block file reads are collapsed into a single edge.
  3. Node ID's are incremented by 1 (so ID's of -1 become 0).
  4. The timestamp field is removed (raw edges are sorted by timestamp). is run as: python <raw edges file>


The raw flow-graph data for StreamSpot was provided by Venkat N. Venkatakrishnan, Sadegh Momeni and team at the University of Illinois - Chicago.