# Benchmarking datasets for Anomaly-based Network Intrusion Detection: KDD CUP 99 alternatives

arXiv: https://arxiv.org/abs/1811.05372 · HTML: https://mlsanity.com/paper/1811.05372/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Nov 2018.

## Built on by (most cited first, 18 of 18)

- [The Cross-evaluation of Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2203.04686/) (2022)
- [New Methods and Datasets for Group Anomaly Detection From Fundamental Physics](https://mlsanity.com/paper/2107.02821/) (2021)
- [The Role of Deep Learning in Advancing Proactive Cybersecurity Measures for Smart Grid Networks: A Survey](https://mlsanity.com/paper/2401.05896/) (2024)
- [Temporal Analysis of NetFlow Datasets for Network Intrusion Detection Systems](https://mlsanity.com/paper/2503.04404/) (2025)
- [Cybersecurity is the True Frontier for Generative AI Success or Failure](https://mlsanity.com/paper/2606.28929/) (2026)
- [Learning to Detect: A Data-driven Approach for Network Intrusion Detection](https://mlsanity.com/paper/2108.08394/) (2021)
- [Improving the Reliability of Network Intrusion Detection Systems through Dataset Integration](https://mlsanity.com/paper/2112.02080/) (2021)
- [Data Curation and Quality Assurance for Machine Learning-based Cyber Intrusion Detection](https://mlsanity.com/paper/2105.10041/) (2021)
- [DDoSDet: An approach to Detect DDoS attacks using Neural Networks](https://mlsanity.com/paper/2201.09514/) (2022)
- [SCGNet-Stacked Convolution with Gated Recurrent Unit Network for Cyber Network Intrusion Detection and Intrusion Type Classification](https://mlsanity.com/paper/2410.21873/) (2024)
- [Behavioral Sequence Modeling with Ensemble Learning](https://mlsanity.com/paper/2411.02174/) (2024)
- [Impact of Data Snooping on Deep Learning Models for Locating Vulnerabilities in Lifted Code](https://mlsanity.com/paper/2412.02048/) (2024)
- [Temporal-Spatial Attention Network (TSAN) for DoS Attack Detection in Network Traffic](https://mlsanity.com/paper/2503.16047/) (2025)
- [Explainable and Interpretable Forecasts on Non-Smooth Multivariate Time Series for Responsible Gameplay](https://mlsanity.com/paper/2504.03777/) (2025)
- [ScarceGAN: Discriminative Classification Framework for Rare Class Identification for Longitudinal Data with Weak Prior](https://mlsanity.com/paper/2505.03811/) (2025)
- [An Investigation into the Performance of Non-Contrastive Self-Supervised Learning Methods for Network Intrusion Detection](https://mlsanity.com/paper/2510.02349/) (2025)
- [Stabilising Explainability Fragility in Cybersecurity AI: The Impact and Mitigation of Multicollinearity in Public Benchmark Datasets](https://mlsanity.com/paper/2605.22529/) (2026)
- [Generative AI and Federated Learning for Intrusion Detection Systems: A Survey](https://mlsanity.com/paper/2607.01305/) (2026)

## Abstract (arXiv)

Machine Learning has been steadily gaining traction for its use in Anomaly-based Network Intrusion Detection Systems (A-NIDS). Research into this domain is frequently performed using the KDD~CUP~99 dataset as a benchmark. Several studies question its usability while constructing a contemporary NIDS, due to the skewed response distribution, non-stationarity, and failure to incorporate modern attacks. In this paper, we compare the performance for KDD-99 alternatives when trained using classification models commonly found in literature: Neural Network, Support Vector Machine, Decision Tree, Random Forest, Naive Bayes and K-Means. Applying the SMOTE oversampling technique and random undersampling, we create a balanced version of NSL-KDD and prove that skewed target classes in KDD-99 and NSL-KDD hamper the efficacy of classifiers on minority classes (U2R and R2L), leading to possible security risks. We explore UNSW-NB15, a modern substitute to KDD-99 with greater uniformity of pattern distribution. We benchmark this dataset before and after SMOTE oversampling to observe the effect on minority performance. Our results indicate that classifiers trained on UNSW-NB15 match or better the Weighted F1-Score of those trained on NSL-KDD and KDD-99 in the binary case, thus advocating UNSW-NB15 as a modern substitute to these datasets.