# A Survey of Network-based Intrusion Detection Data Sets

arXiv: https://arxiv.org/abs/1903.02460 · HTML: https://mlsanity.com/paper/1903.02460/

## Key facts

- Cited by 46 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Mar 2019.

## Built on by (most cited first, 30 of 46)

- [TimeSeriesBench: An Industrial-Grade Benchmark for Time Series Anomaly Detection Models](https://mlsanity.com/paper/2402.10802/) (2024)
- [The Role of Machine Learning in Cybersecurity](https://mlsanity.com/paper/2206.09707/) (2022)
- [SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection](https://mlsanity.com/paper/2305.00550/) (2023)
- [MemStream: Memory-Based Streaming Anomaly Detection](https://mlsanity.com/paper/2106.03837/) (2021)
- [AnoShift: A Distribution Shift Benchmark for Unsupervised Anomaly Detection](https://mlsanity.com/paper/2206.15476/) (2022)
- [Sketch-Based Anomaly Detection in Streaming Graphs](https://mlsanity.com/paper/2106.04486/) (2021)
- [Large Language Models for Security Operations Centers: A Comprehensive Survey](https://mlsanity.com/paper/2509.10858/) (2025)
- [The Cross-evaluation of Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2203.04686/) (2022)
- [Federated Learning Under Attack: Exposing Vulnerabilities through Data Poisoning Attacks in Computer Networks](https://mlsanity.com/paper/2403.02983/) (2024)
- [Benchmarking the Benchmark -- Analysis of Synthetic NIDS Datasets](https://mlsanity.com/paper/2104.09029/) (2021)
- [Active Learning for Network Traffic Classification: A Technical Study](https://mlsanity.com/paper/2106.06933/) (2021)
- [An Adaptable Deep Learning-Based Intrusion Detection System to Zero-Day Attacks](https://mlsanity.com/paper/2108.09199/) (2021)
- [OrgForge-IT: A Verifiable Synthetic Benchmark for LLM-Based Insider Threat Detection](https://mlsanity.com/paper/2603.22499/) (2026)
- [Bridging the gap to real-world for network intrusion detection systems with data-centric approach](https://mlsanity.com/paper/2110.13655/) (2021)
- [Investigation and rectification of NIDS datasets and standardized feature set derivation for network attack detection with graph neural networks](https://mlsanity.com/paper/2212.13994/) (2022)
- [Temporal Analysis of NetFlow Datasets for Network Intrusion Detection Systems](https://mlsanity.com/paper/2503.04404/) (2025)
- [Improving the Reliability of Network Intrusion Detection Systems through Dataset Integration](https://mlsanity.com/paper/2112.02080/) (2021)
- [Prepare for Trouble and Make it Double. Supervised and Unsupervised Stacking for AnomalyBased Intrusion Detection](https://mlsanity.com/paper/2202.13611/) (2022)
- [Leveraging a Probabilistic PCA Model to Understand the Multivariate Statistical Network Monitoring Framework for Network Security Anomaly Detection](https://mlsanity.com/paper/2302.01759/) (2023)
- [Diffusion-based Adversarial Purification for Intrusion Detection](https://mlsanity.com/paper/2406.17606/) (2024)
- [From Flows to Words: Can Zero-/Few-Shot LLMs Detect Network Intrusions? A Grammar-Constrained, Calibrated Evaluation on UNSW-NB15](https://mlsanity.com/paper/2510.17883/) (2025)
- [An Evaluation Framework for Network IDS/IPS Datasets: Leveraging MITRE ATT&CK and Industry Relevance Metrics](https://mlsanity.com/paper/2511.12743/) (2025)
- [BRIDGE and TCH-Net: Heterogeneous Benchmark and Multi-Branch Baseline for Cross-Domain IoT Botnet Detection](https://mlsanity.com/paper/2604.11324/) (2026)
- [Spectral Geometry and Bosonic-Bloch Probes: Explorations in Quantum Learning](https://mlsanity.com/paper/2607.00063/) (2026)
- [Data Curation and Quality Assurance for Machine Learning-based Cyber Intrusion Detection](https://mlsanity.com/paper/2105.10041/) (2021)
- [DDoSDet: An approach to Detect DDoS attacks using Neural Networks](https://mlsanity.com/paper/2201.09514/) (2022)
- [Open ERP System Data For Occupational Fraud Detection](https://mlsanity.com/paper/2206.04460/) (2022)
- [Improving Multilayer-Perceptron(MLP)-based Network Anomaly Detection with Birch Clustering on CICIDS-2017 Dataset](https://mlsanity.com/paper/2208.09711/) (2022)
- [Anomaly Detection Dataset for Industrial Control Systems](https://mlsanity.com/paper/2305.09678/) (2023)
- [Ensembling Uncertainty Measures to Improve Safety of Black-Box Classifiers](https://mlsanity.com/paper/2308.12065/) (2023)

## Abstract (arXiv)

Labeled data sets are necessary to train and evaluate anomaly-based network intrusion detection systems. This work provides a focused literature survey of data sets for network-based intrusion detection and describes the underlying packet- and flow-based network data in detail. The paper identifies 15 different properties to assess the suitability of individual data sets for specific evaluation scenarios. These properties cover a wide range of criteria and are grouped into five categories such as data volume or recording environment for offering a structured search. Based on these properties, a comprehensive overview of existing data sets is given. This overview also highlights the peculiarities of each data set. Furthermore, this work briefly touches upon other sources for network-based data such as traffic generators and traffic repositories. Finally, we discuss our observations and provide some recommendations for the use and creation of network-based data sets.